[Autogenerated] Hello.
Welcome to P.
C.
IDE, CSS Detection Assurance and Management.
I'm John Elliott, and together we're going to look at requirements 10,
11 and 12 of peace.
The idea says these error the ones focused on logging,
testing, controls,
people policies and processes before we dive into the PC IDE CSS requirements.
I just want to quickly go over how this cause works.
If you've seen this introduction on another of my PC IDE CSS courses,
then you'll find to skip this clip.
If you haven't, this will only take a couple of minutes.
You see, learning about PC IDE CSS could be a bit boring Altogether.
There are about 300 individual sub requirements.
Ondas You expect I'm going to talk about each one?
When I did Mike use a training many years ago,
what the instructor did was read out each requirement just as.
It was printed in the standard like this requirements 8.1 point four
remove or disable in active user accounts within 90 days.
Any questions now, as I'm sure you agree,
that's perhaps the most dull training course you can imagine,
and so I'm not going to do that.
Instead,
I want you to make sure you have downloaded a copy of the latest version
off PC IDE CSS from the P CSS See website in the print it out or have it
open in another window so you can refer to it.
When you look at the standard,
you'll see that each sub requirement is split into three sections.
The sub requirement itself, the testing procedure and,
finally, the guidance section,
which describes the intent behind the requirements.
As I talk about each sub requirement,
I'm going to briefly summarize the point of the requirement the guidance on
what you say will look for when they do an assessment.
Then, when we get to the end of a number of PC IDE,
CSS requirements were going to join the discussion I had with Jacob Ansari,
who is one of the most experienced, que essays on the planet.
Jacob and I will discuss the real world issues you need to
know about when implementing PC Idea says.
We'll talk about common problems.
What you say is look for and how security breaches happen.
So I hope at the end of the course,
you'll understand both the theory on the practice of PC IDE CSS.
To get the best out of the course,
you need to understand PC IDE CSS concepts such as what a pan
is the cardholder data environment and PC IDE CSS roles such
as qualified security assessors.
If you're a bit unsure about any of these foundations
than my Pluralsight PC IDE Assess, the big picture course will help.
Sometimes I'm going to need to refer to peace the Ides requirements
in the context of a network or system components.
So I've invented a network for an imaginary merchant that accepts
card payments in physical stores and on the web.
In each store there's a point of sale system,
a local server that collects payment data,
which it then sends over a VPN to a payment server at head office,
which talks to the bank for authorization and settlement.
Once the transaction's been authorized.
All transaction details, including payment card data, a stored in a database.
There's also an e commerce channel, which consists off an e commerce Web server,
thead office sitting inside the DMZ,
which also talk to the payment server through a firewall.
There's also a separate network used to manage the cardholder data environment,
which is self is segmented from the corporate
network on has no access to the 500.
Of course, your network probably doesn't look anything like this,
but it will have the same sort of things in it on most importantly,
the different types of components.
There's the cardholder data environment where cardholder data is stored,
processed or transmitted.
Their is systems that error connected to or that can affect the security
off the cardholder data environment and systems that error intends to be
out of scope of the PC GUID CSS requirements.
That's the end of talking about how the courses structured.
And so now it's time to look at Requirement 10 of PC IDE CSS.