[Autogenerated] I mean, that wraps up 12 10, and that wraps up 12.
Unless, of course, your service provider.
Unless you're services on, there's a new weird requirement 2011,
which is this requirement that service providers have to what they have to.
What does it mean?
What's this requirement mean?
It's a policy and procedure thing, isn't it?
It is.
It is well, and I want to see some, like process artifact from that.
But the goal is is that you're testing kind of your security procedures to
make sure that they're working the way you expect them to.
You know, here is it's kind of like 10.8.
But for people, okay, right, right.
It's our people doing what they're supposed to do Now,
I would expect some of the findings to shake out from this.
Maybe, uh, this person needs more training, right?
They just didn't know how to deal with the situation.
Right?
Or this task is too big for this one person to do so.
We need more bodies or we need more automation, right?
Or, you know,
maybe this person did what they were supposed to do and produced
some piece of information that was useful,
but it didn't get handed off to whoever needed to do to have you
actually start assessing against this one.
You actually doing the physical assessment?
CSS?
How's that going with the organizations with a bit like,
I don't know what to do.
I I think I think we had a lot of these kinds of conversations, right.
What are you looking for?
What are you expecting us to do?
And you know, whenever there's a new requirement,
uh, in PC IDE s s,
there's this pressure to make it as much of a paper chase is possible,
right?
And then assessors have to sort of exert the opposite pressure to
make it an actual thing that does something useful right on dso
that's still in contention right now, right where you know,
there's a lot of pressure to make it a paper chase,
right to just, you know, make it an extra paragraph in the security policy,
right?
That nobody ever looks that nobody ever does anything
about it is the very final requirement.
So people's, you know, patience and tolerance for CSS has probably run out.
Absolutely crashed at this point in time, which I actually hope yours hasn't.
And I hope you actually found this.
This this course of theory and practical experience for the last three
requirements of CSS has sort of brought it to life.
But the last three requirements, you know,
they're not joined up in the same way as the rest of
the standard way started off with,
with effectively logging and monitoring on finding Attackers in our networks.
We then looked at how we tested and tested our defenses with both ___________,
testing and vulnerability scanning on.
Then there's this whole thing in Section 12,
which is basically e used to describe it as Let's keep lots of
paperwork with nobody that the assessor ever reads,
which which can be the low bar.
But actually some of the stuff in 12 we've talked about with Jacob
there with certainly 12 12 to on the risk assessment,
and the Incident Response plan has a real benefit to the
organization of doing secure security.
Well, that's the end of this.
This this final look at the PC IDE CSS standards and hope you found it useful