[Autogenerated] requirement,
12.7 calls for all personnel to be screened before they're hired.
This requirements,
designed to reduce the possibility off insider threat by making
sure that people with access to cardholder data or people who can
affect the security of the cardholder data environment are not the
type of people to steal cardholder data or facilitate other
steaming cardholder data.
There's a few things, actually,
it's quite important to consider with this requirement.
The first is the standard doesn't say what type of screening you should do.
So this needs to be based on your risk assessment.
And it could be that you have different levels of
screening based on people's role.
The next thing to be aware of is the note in the requirement
that echoes the exception requirement.
Ate the people who just process a single card at a time.
So people such as people in retail stores who serve your
customers who just processing a single transaction at once
and for these type of personnel, this requirement isn't mandatory.
It's just recommended.
The final thing I'd like to remember is that who and how
you screen personnel is often a subject to local
employment and data protection laws.
And remember that PC IDE CSS doesn't override those laws.
So if you can't do this type of screening because of
local laws or works council arrangements,
you can still comply with the standard.
The testing procedure is for the QoS SATA.
Go and talk with the HR department to find out what screening is done.
Personally, I was the use.
A.
I'd also look for policies and risk assessments to support this process.
We're going to pause going through Requirement 12 here
because we've covered lots of general policy and procedure
requirements on people requirements.
So it's a good time to join the conversation with Jacob Ansari
where I discuss with him the practical issues of implementing on
assessing some of these requirements.
We're then going to look at the remaining two sections in Requirement 12,
which deal with third-party service providers.
An incident response in the next two modules