[Autogenerated] in this module.
We're going to look at what might appear to be a strange question, Which is?
What does compliance main that?
Now you might think the answer.
This is obvious.
It's to be compliant with PC, Idea says.
I have to admit it wasn't really until I stopped being a compliance focused Q.
S A and Start to work for a car brand that I realized
what an important question this waas on.
That's because I just sat.
One view of PC idea says that it was a security standard to be complied with,
but there are actually two views of PC.
Idea says.
You have to understand.
Yes, it is a security standard.
But how and whether any organization has to comply with it is only
determined by the rules set by the car brands.
Before the car brands woke up one day and decided that they
didn't want anyone to comply with PC ideas,
this it would still exist is a standard,
but no organizations would have to comply with it.
So the aim of this module is to understand how an organization is
affected by the card brand rules and to answer these three
questions because the answers to these questions should really
shape your compliance journey.
Firstly, then what?
The end is, What does being compliant mean for you?
Secondly, a very strange question,
but answering it can often save lots of effort and money,
which is why do you want to be compliance in the first place?
On the final question is, how will you formally validate your compliance with PC?
Idea says.
And actually, that's one thing we're gonna look at first.
I should also add that this isn't a war factor size.
Yes, you need to do this at the beginning of a compliance program,
but it's also worth revisiting.
Is the project or program progresses,
especially if your project or program is going to take a few years?
And that's because those card browned rules and the way
they are enforced does change over time.
As I said,
the reason for asking these questions is to get a clear
picture of our compliance destination.
As the great Yogi Berra said, If you if you don't know where you're going,
you'll probably end up somewhere else.
Although he had a New York accent, so he didn't speak like that Anyway,
you get the point on the three things that will determine
where we're going or what type of p.
C.
I.
D.
S s assessment we require who we need to give that
assessment to and when they'd like it by.
I know I've used the concept of a checkered flag of a finish line
and it just feel like when you get compliance,
you crossed over a finish line.
But there really isn't a finish line with PC,
Idea says, because once we've done our first assessment,
we then moving into keeping compliance and heading to
also a second or subsequent assessments.
So it's It's like a race that never finishes that you just keep
going around a very long circuit on before we spend the next 15
minutes talking about compliance.
I just want to reiterate and save one thing, which is this.
It's really important to focus on security,
to focus on the security of your cardholder data and not to be too
focused on pure compliance at the expense of security.
The penalties for not being compliant a much smaller than the penalties for
not being secure and having a breach of cardholder data.
This is true financial penalties.
Reputational public is any penalties.
You confine cough.
So if you ever find yourself in the circumstance where you making
a compliance decision that weaken security,
it's vital that you stop and think again.
When I think about compliance,
I tend to think in terms of the way that an organization accept
payment cards you'll often have is referred to as the
organization's acceptance channels and typically but could be three
acceptance channels in an organization.
These are face to face retail,
where the customer and the merchant to use be physically present together on
the physical card or or a representation of physical card.
On the on, A device is swiped,
dipped or tapped what we call a point of interaction device.
But everyone else in the world refers to it as a payment terminal.
Secondly, e commerce,
where the customer enters their car data into a form in the merchant's
website and finally mail order or telephone order,
which is often heard here called Moto.
On here.
The customer, either males in a formal cause,
the merchant from reached their card number out over the
telephone or even in some modern implementations they might just
take the card number into telephone keypad.
In some organisations, all of the acceptance Charles they have,
which might be all that all three will join together at some stage,
and the cardholder data from each acceptance channel is off immersion
process together on another companies or organisations.
You'll find that the channels will be kept totally separate from each other,
but actually we can use this channel separation.
There's a way of structuring RPC ideas s compliance.
There are two ways and organization can demonstrate its compliance with PC.
Idea says.
We gotta look at those for quite a while now because that's really important in
determining what that end we're trying to get to looks like.
So the organization can either undergo a formal assessment which will
produce a document called the Report in Compliance or a Rock.
Alternatively,
the organization will complete a self assessment questionnaire or s a que,
which, as the name suggests,
is their own self assessment of their compliance status.
The purpose of the report on compliance in the self assessment question
there is to recall that the testing procedures undertaken and that the
requirement was confirmed to be in place.
The difference between the tuvo is that a report on compliance
is completed by an independent assessor,
whereas the self assessment questionnaires completed by somebody
within the organization that wants to demonstrate the compliance with
PC Idea says to produce a report compliance,
the assessor will collect evidence and make observations that a requirement is
in place on by and they'll be following a testing procedure,
which is defined in the DSS to complete the self assessment questioners.
Somebody in the organization's just answers Yes,
that they've carried out about testing.
There's no requirement in a self assessment questionnaire for somebody to
maintain evidence of what they did to determine that requirement was in place
with the report on compliance or 300 requirements either need to be tested by
the assessor or marked is not applicable.
There are a number of different self assessment
questionnaires based on the methods of acceptance.
So which channels there are on each of both?
Self assessment questions have a cut down number of
requirements that need to be considered,
finally having an assessment that results in a report on compliance?
Will Causton organizations from tens of thousands of dollars,
where is completing a self assessment question there could be
done actual zero cost to the organization because it's just on
internal resource will be doing it.
There's another really important difference between reports and
compliance and self assessment questions I'd like to talk about
because with the best will in the world,
somebody completing a self assessment questionnaire doesn't have the
same rigour as an independent external assessment of the state of
all 300 or so PC ideas s requirements.
And not only does the reporting compliance exist to bride
assurance to to somebody else the UN organisations meeting
its compliance obligations,
but it also provides an independent review of the
effectiveness of the organization's controls.
You see, over time or controls get less effective.
Personally, I call this control decay, and it happens for all sorts of reasons,
for example,
because the organization is focused on something else for a few weeks,
like like a pig trading season.
Well, because some systems get attitude than that.
Working on the person who asked them to the network Forget
Scinto adds them to the patching cycle book.
Whatever the reason, overtime every control loses its effectiveness.
It just decays,
and at some stage it drops below that line whether
control is actually effective.
And here's the problem,
because often the organization doesn't notice that the controls now ineffective.
But that is when the criminal notice the control isn't
working anymore and will take advantage of it.
So the great thing about an external assessment is that
the external assessor will notice,
and then the organization to take the necessary action
to make the control effective again.
The way I look at an external assessment is that it's a brilliant
opportunity to find out what you look controls you think are working and
actually weren't working but actually ineffective.
And you don't get that with a self assessment off.
The three formal PC idea says qualifications we know about only two are
authorized to complete an on site assessment that results in a rock.
A qualified security assessor or que esa can assess an
organization's compliance with PC, idea says,
and completely reporting compliance.
Also, internal security assessors or I essays.
They got the same training and do the same, examines a Q S A.
But they work within the organization being assessed,
so they might, for example, be part of the organization's internal audit team.
It's importantly,
that they're independent from the team that designed and run the controls.
Some card brands know all car brands.
Some car brands allow I essays to complete the report compliance,
and you need to check with whoever is asking to be compliant.
If you can use an I say, or if you have to use a Q S, A.
A PC I professional or P C I.
P.
Because every help with doing compliance things,
but they're not authorized or train to complete the reporting compliance.
A self assessment question there could be completed by a que
esa and I s A a p c i p the company CEO,
Kevin the janitor or even back in the database administrator.
There are no rules.
In other words, about who can complete a self assessment questionnaire.
However,
the final document does need to be countersigned by an officer of the
organization attesting to the fact that all of the PC I.
D.
S s requirements listed in the S a que have been tested and found to be in place