[Autogenerated] we're almost at the end of requirement 10.
And so the last demand is that the organization has the right policies
and procedures to support these requirements and more so that the
policies and procedures error actually documented.
They're available to the people who need to use them,
and they're actually in use.
The Crusades test for this requirement is to both examine the
documentation but also to interview the people who should be
following the policies and processes now.
But for Requirement 10,
it's important to remember that because this requirements mostly about logging,
monitoring and incident response,
this is going to be primarily the Security operations team,
which could also be people in a manage security
service that the QC wants to speak with.
So make sure that if the US A.
Speaks with a sock team, we'll manage Security service provider.
They're aware of the appropriate policies.
It's now time to join the conversation I had with Jacob Ansari,
where we discuss the practical side of logging and monitoring.
In particular,
we look at some of the historical aspects of the standard
on the fact that you really do have to use tools to comply
with the requirements now.
We also discussed the secret to detection is not just
collecting the logs and having the tools,
but actually making sure you've got people trained in an event analysis
and in how to use the tools that you've purchased?