[Autogenerated] now, then, Jacob.
Requirement 12.
We're almost at the end of PC IDE s almost and I know,
having worked for many years, people feel this when they get to requirement 12.
It's like we're almost there is like running a marathon so close
you can see the finish line on the great thing.
Requirement 12 is You can do it really badly and
quickly and just get away with it.
Can't you generally?
Yes, because it's about documentation.
So I'm gonna take requirement 12 going to.
Take it in three modules way.
Got this first modules.
Going to, look at all the documentation.
Right The way up till we get service providers.
Uh, eso a za necessity if you don't require 12 before you've been on site.
If you ask for all the documentation first I ask for
all the documentation all the time.
And sometimes I even get some of this really sometimes.
Okay, hope springs eternal.
Otherwise, what are you doing?
You're looking for a security policy looking for a
risk assessment to begin with, right?
What was an assessor?
What are you looking for in there?
Because Well, so in a security policy, I wanted to see something that describes,
at least at a top level, right?
Some of the information security practices of the organization.
Right.
And then maybe that links into other documentation for,
you know, other of the requirements, right?
Going back to even the policy stuff we talked about in requirement one.
Um, and I want to see who's sort of responsible for this.
I want to see how they how they disseminate this information,
how they organize it.
Who does what?
Right.
At least which job role does what if maybe not the individual person's name.
So you're looking for responsibilities in the policy?
Yeah, ex wives that is responsible for this.
Yeah.
These people, these roles needed to cover these these tasks,
these functions, uh, you know, these these things,
right?
And then the risk assessment risk assessment is maybe the requirement.
I find the most frustrating in 12.2 because I think
it it gives a lot of potential, right?
Do some risk assessment.
Right.
I would put this at the front of the PC.
IDE s s right.
Figure out where your risks are.
Figure out something about your attack surface,
the threats that you're dealing with.
You know the vulnerabilities to your organization and then do something
about it would be sort of how I would write this.
Okay, I've people argue with me and say, Well, why?
What should you do?
A risk assessment.
The council's done.
The risk assessment is worked out.
The controls we need to do they put it in PC ideas.
That's why do I need to a separate risk assessment?
Well, e,
I think I think you want to do some separate risk
assessment so that you understand.
You know how that applies to your organization, right?
I mean, the standard language has to be broadly app, clickable.
It has to cover a lot of different kinds of entities, right?
And And they're gonna be certain kinds of entities.
Where you're gonna mark a lot of the requirements is not app, clickable.
You're going to say that, you know, I don't store cardholder day,
though, you know, a bunch of requiring S3 goes away on,
so you're gonna have a different risk profile than you know,
some other unlike kind of organization on looking at 12 1 12 to
whether people usually fail In your experience,
my experience is that there are a lot of really terrible sort
of risk assessments out there that are, you know,
I hesitate to criticize the medium right,
But there's just a lot of, like, crummy spreadsheets where,
you know, there's a lot of back slapping,
and I don't think this is that big of a deal.
That sort of de prioritize things right now.
There's not much substance in the actual testing procedure, right?
There's not, you know, any sort of linkage.
Say it has to be any good or has to.
It has to feed back into your strategic plan,
or it has to help make your business decisions,
or it needs to compel these other kinds of activities.
It's just not in the statement in the testing procedure,
and maybe it's implied right.
But implication is usually sort of not enough.
It's relatively rare that I fail somebody on this.
I call it non compliant, but very often that I sort of shake my head at it.
So famous Failure is pretty hard because the quality bar is not so.
The bar is pretty low