[Autogenerated] I used to describe piece GUID CSS Requirement 12 as right
policies that no one else but your QoS a will ever read,
which is perhaps a little unfair because,
as the P CSS See always says, security is about technology,
people on processes on Requirement 12 is the one that
most deals with people and processes.
It's a long requirement, but thankfully, most of it is self-explanatory.
There are not many places where there's opportunity for
misinterpreting what the standard want,
although sometimes it does hide requirements in testing procedures.
So the standard starts off with requirement for security policy,
and then it requires an annual risk assessment.
There's also a strangely written requirement,
which basically asked for user orientated policies.
Then a couple more requirements to make sure that responsibilities in the
organization for implementing the Information Security Policy error assigned
to people the final two people focused requirements are that there should be
a general security awareness training on that people with access to
cardholder data on the cardholder data environment or screamed or verified
before they have access.
We're going to cover the last couple of requirements is separate modules
because they're not so much people focused but process focused.
And these are how third parties or as PC IDE CSS
likes to call them service providers.
Error managed.
How an organization response to an incident.
Unsurprisingly,
the people policy and process requirements apply to the
whole of the cardholder data environment.
And actually, I want to make a point here,
which I may well repeat quite a few times in this module because
it's quite important these sync everything in this requirement just
applies to the people process and technology that's in scope of the
PC IDE CSS requirements.
That means, for example,
if only 20 people out of your entire company have access to the cardholder data
environment or can affect the security of the cardholder data environment is
just those 20 people that the requirements apply to,
not to your whole organization.
The first requirement Van is to have a security policy which is published,
managed on made available to everyone.
And if you've been through the other 11 previous PC IDE CSS requirements,
you'll know that the last sub requirement all of them was that you should have
a security policy that mandated PC IDE CSS requirements,
so this should almost already be in place.
The QoS a will go through the whole policy to make sure
it contains the relevant statements.
Now, personally,
I always make sure that I cross referenced 2D CSS
requirement numbers in my security policies,
which makes it much easier for the QoS A.
To find their way around the policy on match My
policy to the PC IDE CSS requirements.
The assessor should also look to see that the policy is published on has
been disseminated to everyone who needs to see it.
The testing procedure doesn't say interview people,
but I'm not sure how else the assessors going to
determine if the policy is being circulated,
so expect them to do this.
There's one sub requirement,
which is that the policy should be reviewed annually because although
the PC is standard doesn't change that frequently.
Your organization and the environment may change,
so your policy should reflect this.
For example,
you may decide to upgrade your intruder detection
system to an intruder protection system,
which would therefore mean that your policy on how the ideas
worked was implemented would need to be changed.
To verify the policies reviewed and potentially updated annually,
the QoS A will look at the policy on also speak with the relevant people