[Autogenerated] That's really the sort of the people
and policy orientated requirements, right?
So thinking of thinking of all those together to 12 1
right the right through to to 12.7, uh, coming back with set,
You said the query e has to be done.
You have to see it, but it doesn't have to be any good as an assessor.
It's difficult to say it's difficult to apply anything
from the text of the requirements to say,
Yeah, you're doing it, but it's kind of terrible.
Okay, The second year, I guess you've got exactly the same.
Same constraints asl long as it's being done, it's being done right?
Would you look for a new risk assessment in year two,
or would you just keep accepting the same risk assess?
I mean, I wouldn't want it says do an annual risk assessment.
So So they changed the year on the front.
If I mean so again,
this is part of this is trying to get an understanding of
what they actually did it literally.
All they did was just update the year right,
and they didn't actually do any risk assessment.
They didn't actually evaluate anything right then know what you've
done is is essentially falsified A document,
right?
And I'm pretty sure I've got terms and conditions that
let me sort of walk away from this.
You do that to me.
Um,
the if you do the risk assessment activities and you arrive
at some very similar set of conclusions,
you know, maybe so.
Okay.
Failures, failures of doing this leading to compromises.
I mean, certainly might.
The one I know best is about not screening employees, probably right.
Not screening employees.
Um, that's e mean, other other requirements don't necessarily lead to failures.
I think maybe if you don't have, ironically,
the stuff in 12.3 about acceptable use for something
like remote access right then, then maybe somebody could do something ______.
And actually, a lot of that is that this is about preventing mistake's,
isn't it?
Right rather than maliciousness, right?
Those of the people in policy was pretty much wrapped up in the next module.
We're gonna look at getting third parties to work with you who
have responsibility for bits of your card,
hold the data environment, or actually have your cardholder data