[Autogenerated] The other thing we need to consider now is how well we
currently measure up against the PC ideas s requirements.
We need to look at our current processes and technology and see if bay me the
particularly prescriptive requirements in the standard.
I've called this a mini gap assessment because,
as we're probably about to change some systems and processes is part
about the scoping exercise is not worth doing a really detailed gap
assessment against every requirement.
But we do need to know if there are things that PC I D s s
requires but we simply don't have or don't do.
For example,
we may have never used changed intentional fire integrity monitoring software.
So this gap assessment would have shown that we need
to procure and deploy that onda,
although in the flow of things I've shown this happening before,
the stuff in organization might do to reduce scope.
It typically often happens at the same time,
and that's because this is quite a hard thing for organizations to
do until you've got a clear picture of what your final scope will
look like and what you're complies.
Target is you can't really assess with your existing security controls a
sufficient or whether you'll need to deploy new policies.
New processes.
A new technology to meet PC Idea says his prescriptive requirements So you saw
need a crystal ball to say What were the final state of PC?
Idea says scope look like and then to a gap assessment against
that final state before you actually created it on this Gap
assessment should consider which PC I.
D.
S s requirements are in place.
Whether there's any technical solutions that need to be born deployed
on whether there are any business processes or policies that need to
be changed on the results of this many gap assessment will probably
BASSEM technology led projects and these technology leg projects will
be able to run alongside the projects associative then into scoping
initiatives.
Having worked out what process re engineering re architecture dates,
deletion outsourcing on new technical controls.
You need the hard work of PC.
Idea says Compliance really starts,
and I've just shown this happening on this one slide.
But I know this could be a war or a two or even a
five year program has some stage.
The program will come to an end the hard work will be over.
You would have created a new card.
All the data environment controlled What other systems and
networks are connected to it by doing segmentation.
And you may feel that you're ready for your first PC
ideas s assessment and he might be right.
But in my experience, you probably won't be ready quite yet.
And so, in the compliance journey that we're following today,
your assessor should come in and do a really accurate
gap assessment to determine away.
You are compliant on where you are not compliant
with the requirements of PC I DSS,
which can then often lead to a re mediation or fixing
phase before the assessment proper.
Now you might not need this remediation face, he says.
I could come in and determine that you're pretty close to being ready
for the production of your first reporting compliance,
and they might change their gap assessment into a
proper assessment in the first few days.
Having looked at your organization,
it's very hard to tell because all organizations are different.
Well, there's typically depends on many variables,
including how much PC idea says you've decided to do and how much change
has been in the organization to get to where you are.
So, as I said, this could be the start of the real assessment.
Or it could be a pre assessment and remediation phase as
we're now entering the assessment of faces of a compliance
program in the next module,
I'm going to take a fresh look at the testing procedures contained within the
standard Onda The reporting documents the assessor will be completing as they
perform the assessment and that so you can get an understanding of how
rigorous the assessment process will be.
I'm what the assessor is looking for.
But before we do that,
let's hear from Jacob again about how he manages scoping
decisions in very large organizations and also discusses some
examples of good and bad scope reduction.
But he has encountered as an assessor