[Autogenerated] Now we've covered some of the essential foundations,
his typhus, to start the journey to compliance.
But just before we do, there's one thing I have to point out,
which is that there isn't anything written in the standard,
but there's nothing a PC idea assess that says Prescriptive Lee.
This is how you comply with a standard and then some.
For the rest of this course.
I'm just going to tell you how I do it and how I've seen it
done in hundreds of other organizations.
But if this journey doesn't work for you,
if you need to move parts around, then feel free to change it.
As I see it, there are five key faces in any compliance journey.
The preparation phase, which leads into the understanding the current scope,
that PC idea says would apply to in an organization phase the
face of business process and technology.
Reengineering designed to reduce the scope of PC idea says in an organization,
and to add any necessary technical to controls that
are not in place remediation phase,
which is when you test your new scoping controls,
you put in tow, work out.
If you actually do meet the PC ideas as requirements and then,
finally, the organization's first formal assessment.
And then, after that assessment, the organization should move into,
ah, business as usual, her maintenance phase,
which keeps on going for the rest of the organization's life until it
decides to stop doing things with payment cards.
Sure, you might have guessed.
Each of these faces contain a number of steps.
I'm going to look at each step individually,
starting with the prepare phase on the understanding.
The scope phase,
which we're going to look at in this module and in subsequent modules,
will look perhaps at the hardest face.
Many PC idea says program, which is scoping segmentation,
scope reduction and adding technical controls.
And when that's finished, we enter the re mediation of phase,
which is where you test your controls to make sure they're
up to the standard PC ideas s requires.
And then that will naturally lead into the first assessment on these two faces.
The remediation facing the assessment face sometimes happen in
parallel and talk about the relevant time.
But for now, let's talk about the preparation phase.
It's not that exciting, and it's the one that people spend the least time on.
But actually,
it's the one that you should spend them most thinking on
because time spent in preparation will make a compliance
journey much more straightforward.
And generally it'll cost a lot less than if you skip over this phase.
And in fact,
I would say that all the failures of PC I program I've seen has
Bean because this face wasn't done at all.