[Autogenerated] now, Jacob.
Requirement 12.8 service providers.
The one that causes no end of grief of the planned on it should be quite simple.
So we've just been through the theory of it practically as a QoS Azure.
You're walking on site.
What are you looking for?
We're gonna ask.
Well, first.
So, in an ideal situation,
I want to see these organization knows who all their service providers are.
Okay, so we're looking for a list of them, right?
And some sort of procedure from managing service providers.
How they engage, how they how they maybe wrap up when they're done.
And, you know,
conceivably if there's some sort of network or or logical connectivity,
how they establish it, how they make sure that that works.
Okay, Right on, then.
Ideally,
the other thing I'm looking for them are the compliant ao CSS from
those service providers that the client is collecting.
Are you looking for a contract to be in place?
There's a contract need to be in place.
You know, I don't actually have a requirement for a contract.
Right.
Um you know,
the peace IDE AD CS doesn't really get into sort of
the brass tacks of contracting.
It's just written agreement.
Yeah, it does a written agreement.
So whatever shape that takes, um and you know,
whatever shape it takes where the I mean again.
Ideally, the organization wants to demonstrate PC IT CSS compliance for,
you know,
are accepting PC responsibility for for the service providers that it's using.
So you've got a list you're looking for a written
agreement which could be a contractor.
It could be a letter.
It could be something, something or terms and conditions on on a public website,
Right conceivably that you're taking off.
And now you're looking for evidence off that third parties compliance.
You're looking for a to attestation of compliance.
That's that's really what you're you should be looking for, right?
You know,
based on some of the guidance documentation about
interacting with third-party service providers,
right,
if they're providing some service where they're involved in in
handling payment card data or affecting the security of that's
what they should be doing right?
And this is this is where all the grief happens.
So there, too, after stations of compliance,
one that comes with a self assessment questionnaire,
one that is a result of an on site assessment by qualified security.
Assessor uh, do you care what you get?
Yes.
Okay.
Yes.
So, uh,
the self assessment questionnaire is just that it's
the organization assessing itself.
Yeah, right.
Uh oh.
And maybe they're doing so correctly.
Maybe not.
Right.
But the point of the self assessment questionnaire was
essentially a risk decision by the payment brands by the PC IT
council by the acquiring institutions to say,
there's this category of institution that the the sort of useful risk
decision for us is to have them assess themselves rather than compel
them to obtained services of nested.
Right.
But if that entity is a service provider,
right, providing services to other kinds of organizations,
right and consequently affecting their security,
right?
The idea that they can self assess.
Yeah, it is pretty silly.
Okay, but what if you don't?
What if that's all you get?
You telling your client that they can't use that service provider?
Uh, it could be the case then, that if that client,
if my client has only that from the service provider,
that I would then go to the service provider and say,
Well,
I'm I'm willing to essentially incorporate your stuff into my
assessment of my client or go get an assessor,
right?
S o e.
I mean, that that's that's a sort of hard sort of bargain to Docker, right?
But that's I mean, otherwise, what assurances do you have?
I mean,
I don't I don't take my clients assurances we completed this questionnaire.
You don't need to ask us about patching right on.
This third-party is part of that environment, right?
So why would I take their self A to AD DS station?
Their self assessment saying, Yeah, you don't have to ask us any questions.
We take all these boxes for you because they're gonna be held
contractually liable if they're if they're telling a fib.
A conceivably.
Um, if if the service provider is telling a fib or is just miss taken right,
let's give them the benefit of you know,
our our, uh and my client gets breached,
right?
My client is holding the bag with respect to the payment
brands or the acquiring banks or what have you,
Right?
Um, and if they have any recourse against that service provider,
right,
its's them basically bringing legal action against the
party based on whatever is in the contract,
which, you know, may or may not have any meaningful substance.
You're not like us.
You're not gonna get into that.
Well, do you have enough liability?
Yeah, I'm not an attorney, and I'm not going to pretend to be one.
Right.
And so saying, do you have any legal recourse against this entity?
E don't know, right?
Somebody else's job to find that out.
Okay,
so we've got a list we've got written agreements were gathering
after stations of compliance done by an on site is nested all you're
going out on assessing the third-party.
Is part of this part of it, right?
Um,
on that guess is to the end and you pass the the only other piece I would say
is when you're gathering those adaptations of compliance,
right?
This is where you want the client to have some meaningful process to do that
because I want to say they want to make sure Does my third-party Are they
getting assessed for the relevant requirements to me?
Right.
So maybe the easiest examples, if you have,
like, a managed services provider, right,
That's providing, like,
managed operating systems error managed networking devices,
right?
Did they just get assessed for the physical security of their co location space?
Or did they get their manage services assessed Also?
And if their coverage isn't equivalent to your service use,
then you got a problem.
My reflection on that is many people buy services optimistically, right?
They get the AOC and do brilliant.
I've got the O.
C.
Don't look at it right,
And it's actually really important because many times vendors make I'm
gonna give him the benefit of the doubt a mist ake on sending an AOC for
a service that actually that you're not buying where they don't have a
NAOC for the service you are buying.
I've seen it so many times that it's such a common mistake's that sometimes
sometimes I doubt the integrity of people who were doing that.
That does happen.
So I'm gonna be, you know, being really honest.
You have to check, but what you're buying.
But iOS covers my favorite about that was actually finding.
I think this was a It was a version 3.0 a.
O.
C.
After 3.0 had ended right,
and the date on the AOC was after the sunset of 3.13
point one was supposed to be used, but they're just hopeful,
you know?
Well, you know are essentially daring you like.
What are you gonna do?
Fail me for that?
Thanks.
Do we really need to throw down, right?
Really?
Also, in terms of service providers,
there is some people are not service providers.
For instance,
you're acquiring bank is not a service provided to You
don't need to ask your acquiring bank for their AOC
because they're probably laughing.
But it might be fun if you try, but other, you won't get success.
I have seen those listed in section 12.8 on many
occasions where the QoS adjust says, Well,
you you give the Dodgers the acquiring bank,
so we have to list all we have to list them on if they're listening.
12 8, you need you need evidence and compliance, don't you?
Yeah, I've seen that happen, right?
And and there is a section in the summary part of the rock where that says,
who are the entities that you are, you know,
sending payment card data to where you should list all the
acquiring institutions error payment process,
but that's not the same thing is 12.8.
But the problem is that section in the rock at the bottom says
these people will be listed in 12.8 IE6.
A bit of bad.
It's bad type Power BI.
There's a little bit of that.
I actually have one.
Where we were employing a service provider who sent
the card data to us that you get.
You get odd situations like that,
or or sometimes you have a situation where there is an entity
that's a merchant and a service provider.
And sometimes you get these kind of, you know, tail wagging the dog situations.
Yeah, but the end of the day,
it's Whoever's got the contract with the payment brand is the person that's
responsible for making sure that everyone else is compliant,
right?
Yeah.
And then this needs to be an ongoing thing, doesn't it?
So you're coming back from assessment in year two.
You're not gonna accept the same bits of paper, are you?
They should get new ones, right?
You know, I have this situation where, uh,
a lot of my clients, uh,
host their stuff in co location facilities who are also our clients.
Right and they get this sort of weird expectation that I'm just
going to go bother my colleagues for the A.
C.
S.
For those entities that seems reasonable.
Well, e like the mechanics of that I don't care, right?
Like Okay, fine.
I'll go.
You know, find it in our file share somewhere.
That's fine, right?
But the point is, you need to have some process to manage your service provider,
right?
And that process can't be bother, your assessor,
because they also assess your services.
Absolutely has to be where I've worked.
You know, we create a calendar, and so we know when the AOC expires.
So we go back like, two months on.
There's a calendar reminder to contact the service provider and say
you're gonna be out of compliance in two months time.
What are you doing about it we're working at?
Because that's often the real early warning We go.
Yeah, we decided not to do it this year.
And iPad, That's right.
It's like you can't decide not to do it.
It's written in our contract, for example.
So find out early and then and then chase.
But e mean in big companies,
that's actually that's a full time job for someone is
absolutely be a full time job with a large enough
organization with enough service providers.
Yeah,
you could spend your whole time chasing AJAX and barking at people
saying when you're gonna get your revalidation done.
No, I mean yeah, literally.
We do.
I mean, I work places where you do that.