[Autogenerated] the next requirement, 12.4 is much simpler.
It just wants to make sure that the security policy
defines specific responsibilities.
Now,
the way I tend to implement this is that include the responsibility on
the accountability is part of each policy statement.
So, for example,
if I was writing a policy that required the organization to
conduct six monthly firewall reviews,
which I'm sure you will remember his requirements 1.1 point seven I'd also say,
for example,
that the head of network infrastructure was responsible for
this on that the CEO was accountable for it.
The testing procedure for this requirement is for the QoS a to review the
information security policy and also speak with the people,
the policy says error responsible on make sure they agree
with the policy that they are responsible.
Now there's a separate sub requirement here,
which is just for service providers.
So just for service providers and this is to ensure that the
responsibility and accountability for overall organizational
compliance with PC IDE CSS is clearly defined on.
There are two quite strange parts of this requirement.
The first is that accountability for the organization
maintaining its continued compliance with PC IDE CSS is
allocated to someone that's pretty clear.
The second is that there's something called a
charter the PC ideas as compliance,
which has Bean communicated to executive management.
You're probably asking yourself two questions.
What's a charter on who were executive management?
Let's see if we could make that simpler.
The charter is intended to be a formal document issued by Executive Management
committing the organization to comply with the standards.
This was added as a requirement,
so the executive management couldn't deny they knew about this
pesky little annoying thing called PC IDE CSS on.
There was some minor managed the responsibility they had not been aware of,
which is why they never bother complying with it.
So that's the charter on what constitutes executive
management is detailed in the guidance.
Has all organizations error different?
They're going to call their executive different things,
But think c suite Xcode board of directors,
and you have the right sort of level.
The testing procedure is just for the QoS A.
To review the charter on the documentation to evidence that executive
management has assigned accountability to someone.
Surprisingly, the que se doesn't have to interview at someone on.
Honestly,
if I was there QoS a I'd want to check that accountable
person knew they had that accountability.