[Autogenerated] in this module,
we would be looking at what is probably going to be the
longest phase of your PC ideas s journey to compliance In
scoping segmentation of scope production,
we're thinking about how many systems,
networks and applications will need to comply with the PC ideas s requirements.
And although I've split this journey up into these faces,
it's quite possible now that the way you approach your compliance
journey may combine some of the activities that I've actually put
into separate faces in this module.
We start off with the as his picture we worked out
at the end of the last module.
Remember,
that's are accurate picture of the way that our organization
currently processes payment cards with then go to do a couple more
bits of thinking where we decide how large an environment we want to
make comply with PC idea cess and also make an initial assessment of
the technical controls,
policies and procedures that may be missing in our organization.
That's going to give us a big work plan where we re engineer and re architect.
Our systems deleted wanted data and maybe outsourcing business
activities had the end of all that work.
While which may take a number of years of a PC,
I program,
we end up with our new picture of the way we store
process and transmit cardholder data,
which gives us a new scope for RPC ideas s compliance assessment.
And that is typically time to get an external assessment of that new scope.
To see how far away we are from meeting PC idea
assesses prescriptive requirements.
This exercise will generally lead to another face of work where we re
mediate problems found in that initial assessments.
Then we really ready for our first formal PC ideas s assessment in this module.
I'm going to use the word scope quite a lot,
and you'll often hear people talking about scoping and scope
reduction when they talk about PC idea sets.
One quite annoying thing is that scope is often used to
mean different things to different people.
Sometimes when people use the word scope,
they mean we need to consider whether the system application
that work or person has anything to do with PC.
Idea says it's in scope of consideration and is part of any assessment on
Assessor will look at the entire organization who want to know your
justification for saying some parts of the organization are outside the scope
of PC idea set where others are within the scope of PC.
Idea says.
The second way that scope is used is to say that a particular system,
person or network is in scope of some or all of the requirements.
That PC idea says demands if an organization stores,
processes or transmits cardholder data,
everything Enver organizations in scope of consideration.
But not everything will need to comply with some or all
of PC idea assesses requirements.
Now you may remember this slide from the big picture course because it describes
which systems are in scope of the PC ideas s requirements.
We start off with the cardholder data environment or C d A,
and that's defined as any technology,
people or processes which store process transmit
cardholder data on by technology.
We basically mean networks, systems and applications.
Once we define the CD, we've been need to determine the technology,
the people,
the processes that are also connected to the cardholder data
environment or that could affect the security of the TV.
Those two environments together described the scope that the PC I.
D S s requirements will apply to One thing to be careful
about is that some of the PC idea says requirements only
apply to systems in the cartel, the data environment.
And so when you look at a requirement when you're doing PC,
Idea says it's important to see whether this requirements just be
restricted to active in the carnal data environment or if it
applies to connected to systems as well.
Another way of thinking about PC idea says scoping, is to imagine three zones.
The inside zone is the cardholder data environment,
which contains the systems that store process or transmit cardholder data.
The next zone is the connected to zone,
which includes systems that are connected to the cardholder data
environment or that can affect the security off the cardholder data
environments and then in the final zone,
the systems that are not connected to the CD at all.
One really good way of determining whether a system is
connected to or not connected to is to think what would
happen if that system was compromised.
But the way I like to think of it is that for systems connected to the CD,
if they're compromised.
The Attackers got a foothold into the cut.
All the data environment.
So I care about that.
Where a systems that are not connected to the CD A.
If an attacker compromises them, he might be bad for my organization.
But I'm not worried about the security of cardholder.
Data, in fact,
gives us three logical scopes systems that in the cardholder data environment
systems that are connected to the cardholder data environment always could
affect the security of the CD and systems that we've looked at considered and
decided that Law of the PC idea says requirements replicable because above
their part of our organization,
they don't fall into the other two scoping categories.
Now we're at the stage where we have an accurate picture of the
systems in our organization that store process,
transmit carnal the data.
Andi, If we mapped both authorization and clearing separately,
we know which systems contain primary account numbers on which
systems also contain sensitive authentication data,
as well as knowing the technicalities of where cardholder
data flows through the organization.
We know the business processes which generate those Cardell
the data flows and really importantly,
we know who to go and talk to if we need to change those business processes,
we've hopefully got an inventory of all the third party service providers
that store process or transmit Kartal dilator on our behalf or who could
affect the security of our cold hold of data.
Which means we're now in a position to determine what our
cardholder data environment would look like,
what systems networks and what applications air in it.
And then, more importantly, we can see how many systems are connected to our cut.
All the data environment poor can affect the
security of the CD eight and honestly,
when most organizations first completeness exercise.
But you realize that their entire organization is in scope,
have all of the PC ideas s requirements applied to it and bat Liza very nicely
to the next big thinking stage of the compliance journey.
And the question we need to answer is how much PC idea says,
Does your organization want to do?
Do we want to apply all those prescriptive technical controls toe every
system application and network in our organization?
Other new things we want to do anyway and doing them at the same
time as we consider the scope and size of RPC,
Idea says.
Environment is a sensible thing.
Other business processes,
particularly around how we accept and process payments that we want to change.
Well,
perhaps we want to use PCR DSS compliance as a catalyst to
change the organization's security profile.
We also have to realize that we might want to do lots of things,
but the organization is under a constraint of being
compliant by a certain date on the finally do we understand
any cost constraints for the PC idea?
Says compliance.
In this notes clip,
Jacob and I discuss how an organisation's culture can affect scoping decisions.