[Autogenerated] let's go to 12.3 is really annoying these
critical these usage policies for critical stuff,
right?
What the heck does that mean?
Well, so this is a particularly interesting one.
If you've been around PC AD DS s for a long time,
Uh, 12.3 now talks about critical user facing technologies.
Right?
So I've had, you know, the stories of assessors, right?
The sort of horror stories where the assessor says,
Where is your usage policy for your servers or something like that?
Right.
And they've read the critical technology, but not the user facing technology.
Now that this requirement began, like way,
way back in the in the early, you know,
mists of time as a policy for things like modems.
Motive.
Yeah, once upon a time, yeah.
And the kids were like, What's a Yeah, yeah.
Um, but but it began life, you know, for for those kinds of devices, right?
Is is a sort of user facing, you know, remote access,
sort of mechanism that very often could be sort of a
blindingly obvious ________ into the organization.
Right.
So what does this device do?
Why is it here who uses it right,
So then the things like contact and labeling and,
you know, whatever makes sense in that context.
And then somewhere along the way, somebody sort of excavated,
You know, this requirement and, you know,
replaced it with the user facing technologies.
This is kind of I mean, we don't have this in America,
but you have this in Europe where there's,
you know, some building that's built on top of the ruins of the old building,
and then something that's built on top of that.
And then finally, there's a street on top of it.
Right.
Um, this is this is that right?
There's an assessor.
What are you looking for?
Because I always struggle with With what?
What?
The intent With what?
The security value of this requirement S O.
I want to see you again for the user facing technologies that
are Jermaine to the in scope environment.
And that may be remote access, right?
And not much else, right?
Or if there's again workstations in, like,
a contact center or something like that,
then maybe you know, the the user facing stuff on those workstations.
The Internet browser, Uh, you know,
email clients or other things like that that now,
if you have those in your in scope environment,
you need some procedures to say.
Here's how you do smart things on the Internet,
the Web browser and not do ______ things So and again.
No quality threshold, very little.
So you can you can.
I mean, there's not, you know, I'm scrolling through here.
There's pages off these usage policies,
some of them being in what we call except a apps error.
Acceptable usage policies that given to users some will be just like,
Well, here's your company phone.
And here's how you use your company phone, right?
But you're just looking for them being there generally and addressing
the you know what's in this sort of testing procedure,
right?
And I'd say, by and large,
if it's if it's sort of meaningfully written for
that organization's actual case, then yeah,
it will clear the quality threshold because the bar is pretty low.
Okay, top 0.4 security policies and procedures clearly defined for personnel,
right?
What are you looking for?
That So who is responsible again?
What roles are responsible for certain information security tasks?
Uh, and what roles do sort of the ordinary folk you know,
in the organization have I'm the services This really
weird One for service providers in 12.4,
right?
The charter, The charter?
Yeah, tell me about that.
So I think I think this comes out of the need to sort of
defend against kind of bad faith efforts.
Right.
Uh, you know,
if there's a if there's a case where there's a
security incident or there's some,
like a long period of non compliance or some other problem like that,
Uh,
and the management team of that organization is trying to sort of
roll it up and hanging around the necks of the I T.
Or the compliance people, the subordinates in the organization,
like, Oh, well, they didn't They didn't do their jobs.
They didn't tell us about this.
And maybe maybe they've been screaming about it for years and
years and and the management of saying la la la,
la, la I don't hear about vulnerabilities,
right?
I don't need to patch, uh, you know,
the charter requirement is intended to be the thing that connects the senior
management of that organization with the compliance program,
rather than insulate them from it so they can't say I didn't
know I didn't have responsibility for that.
And is this a thing that you could get a template from your PC IDE SSH Charter?
Or is it something that basically says we the management,
acknowledge we've got to be PC ideas has compliant.
And here's how we going to do it e you can do that.
I'd say the template that I find is actually
organizations that undergo a nested 27 w want to audit
where they are very similar requirements,
right for the management to take responsibility for stuff and have some defined
means of communication rather than some sort of quarterly meeting or whatever
where somebody could go presented here are problems,
so it's almost like having a mini SMS and information security management.
It is for peace of ideas.
And in fact, you know, inside of an actual is M s eyes.
Probably most of what you need for this.
Okay, so 27,001 would give you the basis for the basis for this, right?
Just just tune it for PC IDE.
SSH!
Sort of stuff in.
There you go.