[Autogenerated] now talking about scoping large organizations.
Do you have any tips for very large organizations?
Because I've seen, you know,
organizations complain that sometimes their assessment takes six months because
their organization is just so so big that that can't happen.
Yes,
where you get a very large organization that's got a very complex environment,
really Siris of environments.
In some cases, and I've seen very large organizations.
I've worked with some very large organizations that break
it up into individual business units.
Right.
This works particularly well when those business units are self contained,
right arm or self contained.
Uh, or, uh, you know, where there may be the results of acquisitions, right?
And so they have some natural boundaries that make a lot of sense.
One of the things that we have done for certain organizations is do
like an infrastructure layer kind of assessment.
Right?
Uh, for the common aspect that when you say an assessment,
would you actually write a separate report on compliance for that?
Yes, right, right.
Eso right.
A separate report on compliance for the network services.
Right for the team that manages firewalls or network devices across the whole
enterprise or the team that provides the security monitoring services across
the whole enterprise or the policies and procedures that apply across various
parts of the business and then essentially treat that entity like a service
provider to the individual business units that use those shared services for
their networking,
for the security monitoring for other aspects of what they do on,
and then assess each individual business units for the
things that are particular to them.
In some cases, that slices the requirements somewhat,
finally, right where there is, ah, common component that we've already assessed.
We've already looked at We're not gonna do it again.
But then, for that individual business unit,
you've got to show me how you fulfill that,
right?
Right.
Show me how you meet that procedure.
Show me your specific instances of compliance with that on.
That's acceptable to acquiring banks onto the carts.
Games to do have multiple rocks covering a single, and it is it is.
It can be.
In many cases,
it's often very useful to discuss that with those
acquiring institutions or those card brands,
and particularly since these air for very large organizations there,
the kinds of organizations that can command the attention of car brands
or requiring banks to have that conversation and say,
This is our approach.
We want to do it this way.
And if you make a good case for it,
usually those entities air pretty accepting of it.
Yeah, I have great one from Ah ah managed hosting provider.
They gave me two reports on compliance.
One was for the infrastructure wants for their management services.
So because you could buy them separately,
so they had to separate reports of plants and that was really helpful.
That's a great case.