[Autogenerated] now closely aligned with the
requirement to update the policy annually.
And one of the factors that may lead to a policy update is PC IEDs
requirement to conduct an annual risk assessment.
Now I've heard people argue that this is a useless requirement
because in developing the PC IDE Assess,
the P CSS C has done the risk assessment for you and worked out all the
threats and therefore the controls that required.
I'm afraid that's simply not the case,
because the DSS is a baseline security standards.
There are millions of companies all around the world that process
payment cards right from single site small e commerce merchants to the
world's largest airlines on supermarkets.
Onder standards also fairly static,
so it doesn't change as quickly as people invent new
US of processing payment cards.
So you have to do an annual risk assessment,
a great example of why we need annual risk assessments and
how the way we change with way we process payment cars mean
we need to do risk assessments.
Is that JavaScript key logger attack?
I discuss with Troy Hunts in a Pluralsight play by play
that new way that e commerce merchants accept payment cars
has its own vulnerabilities,
which a risk assessment would have identified and then found some
new controls that should have been applied.
So every organization needs to look at how it works.
With payment card data,
y excess will be attractive to Attackers and understand how
they're going to defend and protect those assets.
The requirement is that the risk assessment is done each year and
also after significant change in your environment.
Whatever risk assessment methodologies used,
it must include the core components of asset identification,
threat, identification, vulnerability, analysis and,
most importantly, but the risk assessment has to be documented.
The QoS is going to review the risk assessment and check that
it was completed within the past 12 months.
A good QoS A would also look to see if the policy required in 12.1
had been amended as a result of the risk assessment