[Autogenerated] Let's take one final look at the retail network and see
every architect in a business process re architected.
Some networks could also help to reduce the scope of PC idea cess.
If we didn't want to do something like the point to point encryption solution,
what we could do is,
rather than a route the car Datar through the point of
sale system into the store server.
We could put the point of sale systems on a completely separate
network and haven't talked directly to the acquirer segmenting
the point of sale system in the store server from the network
that carries cardholder data.
The payment terminal could still send a truncated pan
through to the point of sale system.
And yes,
that means we're not getting the information to the payment system to be
able to produce the clearing file at the end of each day.
But it will be really unusual if that could not be
outsourced to a payment process.
Auto in acquiring bank with a daily reconciliation file
sent back into the payment system,
it's actually really hard to discuss changes in scope and business
processes because every organization is unique in how it processes
payment cards and how it wants to conduct his business.
There are some very common patterns that being
established in the payment industry,
and I've tried to show you some of those in the previous examples.
Outsourcing.
Replacing cardholder data with tokens or truncated pans and
segmenting networks are the three most common techniques people
will use to reduce the scope of their PC idea,
says compliance.
And this is one reason that I'm insistent.
That PC idea says compliance isn't an I t.
Problem,
because working out how to reduce the footprint of Kartal today to
across the organization is a business issue.
There's one piece of advice,
but I can't emphasize enough when you've decided
what your new scope will look like.
It's really important to validate this with your qualified security assessor,
who will be independent from any supply you may be working with
because you don't want to get to the stage of having made a large
investment in the business process,
re engineering or or outsourcing or network segmentation,
ALS or a new technology,
only to find that your assumption about how that would change your
organization's PC idea so scope was incorrect.
Scoping is a complicated thing in PC Idea says from a car.
Emphasize enough how important it is to minimize the attack surface on
the ongoing cost of compliance to make the footprint of cardinal the
data a smallest possible in any organization.
Now there is this really interesting guidance document from the PC I SSC,
but talks about scoping it talks about shared services,
and it shows some common patterns of ways that people may may reduce,
scope or understand scope, so it's a really useful document to review.