[Autogenerated] Okay, Then we get the 12.5,
which is almost saying the same thing again.
I'm like we need named individuals to do things, or at least, you know, job.
You're looking for roles.
They're not people, right?
Yep.
So again is a necessity error.
Going to going to assesses.
What are you looking for?
This is a document we actually going to.
Do you actually interview the people to say,
you know, you have this responsibility?
I mean, I would want to confirm that.
Yeah.
Those people understand that.
Yeah, this is what I do.
This is what I have responsibility for, but yes,
there needs to be some sort of documentation in small organizations.
Is this all the same person?
Sometimes it can be,
um and sometimes that is sort of troublesome from kind of
a conflict of interest perspective.
Uh,
but usually that that sort of manifests in other
requirements that we've talked about previously.
Where you want to make sure there's some independence and
we get to security awareness training, right.
The bane of every the bane of my life.
Because, you know, wherever I'm working,
I have to do security awareness training to take the compliance.
Actually, prepare it for my organization,
so they get to listen to me, ramble about that every year.
They love it.
The funniest thing happened to me when I was working for a car brand.
I still have to do the PC Security awareness training
despite being the rep on the PC IT council.
So I had to take my own training last year on There's No way out of it.
There's also no quality.
Threshold is very no,
there's no there's no you have to verify provides awareness,
right?
What's awareness?
I mean, what are you looking for?
And so what I want to see in something like this is something that
is intended for the but the general user population that is
involved in the cardholder data environment,
which may actually be a pretty small subset of the number
of employees within the organization.
Uh, that is sort of appropriate to what they do now.
It may be the case where the only people that are really involved
are sort of I t folks error administrators,
right?
In which case it should be sort of useful to that right?
And so the sort of general security awareness kind of stuff that
you could maybe fish around on the Internet for it might not be
might not be particularly appropriate.
So the necessity you're looking for something that's
relevant to the person's role, not just a generic payment.
Cards are dangerous.
Yeah, yeah, exactly.
That right?
That I would want to see that I would want to see sort of the materials.
I wanna make sure that your main maybe you've got sort of different sections,
right?
If you're an I t person, these error your roles.
If you're a software developer, these error your roles.
If your management these error your rolls, right, um and then some.
Some record of attendance at the least.
Yeah, that have to do a quiz or anything that they just have to be.
Yeah, there's not.
There's not a requirement for some sort of quiz or sort of
evidence of actually learning anything.
Um, you know, which again is unfortunate.
So it's a necessity.
You're looking at the quality of the material.
Did it cover what they need to do IT?
You're looking for a record of attendance, right?
And and the text of the requirement talks about sort of
multiple means of communications.
Eso that and And that can be very broad, right?
Uh, that can be, you know, of course you know,
in is classroom learning or CBT or, you know,
some sort of regular, you know,
notifications from somebody saying your concerns about fishing or whatever.
Uh, like, uh, there is a threshold for making sure that you're doing that.
You know,
having more than one sort of channel for delivering
security information to your organization.
But the threshold is pretty low on the thresholds to effectively use yes,
um, train annually on higher and annually,
different training every year, or the same boring 35 minutes of PowerPoint.
Strictly speaking, I don't think the requirement, you know, compels you to.
Now,
I would say if it's the same training you've been doing for 10 years
and you know it's talking about modem security,
right?
Like maybe we have a concern, right?
If if the reality of the organization sort of use case has drifted off,
what the training covers, right.
But there's no express thing to say.
Go to new training next year to make sure that it stays fresh.
So again it has to be done from from an assessment perspective.
Really low bar.
It is a pretty low bar.
What about the next requirement,
then screening employees or workers before they're getting access to the C.
D.
S.
So this is the other requirement where sometimes you sort of tick the box in the
AOC saying we didn't do this because of legal constraints.
Right?
Certain regions in the world have very specific laws.
Quite a bit.
Yeah, bits of your app have got very straight, right?
Latin America, other places like that.
I mean, in the US, for good or for ill.
You know, there are no such restrictions, right?
Uh, so So the goal here is, you know, for the relevant people, right?
For the people with access to the environment,
do some sort of background checks, right?
And it's not going to say you must do these kinds of criminal checks,
or you must do these kinds of credit checks,
or you must, you know,
check their You know that they haven't falsified and error
academic information or anything like that.
So that's actually looking for a policy.
First, I'm looking for some sort of policy or procedure.
Here is what we do, um,
to gather this information and then make our hiring decisions.
You know, involving that, right?
You can't even say.
At least I'm pretty sure you can't even say sort of legally that,
you know, if there is a thing in the criminal check that you then don't.
Or at least I don't think the requirements compel me to say,
Don't hire anybody with a felony convictions.
The requirement doesn't.
But I think the requirement so we should have a policy of what
we do is a motoring offenses of this bar,
right?
Yeah.
Is e mean where I've worked in financial services.
You know, any any fraud convictions, for instance,
means you probably working financial services?
Probably not.
Probably not, but there's a policy that there's some sort of policy,
or or and and and very often what I think a lot of organizations to do,
sort of at the behest of their council is hedge and say,
if there are felony convictions, if there are frauds,
if there are, you know, whatever,
then then you know it becomes a judgment case based on you know,
something like that.
This doesn't apply to everyone,
doesn't it doesn't apply to people who a standard says I want to emphasize
this because I've seen assesses get this quite badly wrong.
Time doesn't apply to everyone handling a single card at a time.
I e someone in a store taking cache, right?
A person on the telephone taking IT, you know,
in the in the contact center, right?
I mean, actually, personally, the people in the contact center,
the ones I've met the most strongly right from looking at evidence of
data breaches that that seems to be good strategy.
But it is not actually requirement.
Right?
Okay.