[Autogenerated] in this module,
we're going to take a closer look at the standard itself.
The plan is that we will have exactly the same knowledge as an assessor.
We will look at how the standard is assessed against on of
the documentation that the assessor is required to complete
this part of the assessment.
We're going to start off by reminding ourselves how the standard is structure,
because the standing itself aims to provide as much information as
possible to help with interpretation and understanding.
Next,
we go to take a closer look at what successive does when they do an assessment,
and especially at the testing procedures in the
standard that the assess has to complete.
As part of their assessment,
we will explore how the assessor has to report what they did so they
could determine whether requirement was in place or not.
We'll discuss what happens when you can't agree with your assessment because,
yes,
but sometimes happens and then finally would explore how are
compensating control is constructed and the other things you can do
when you cannot me a requirement as it is written and very quickly I
want to just go over some of the material we covered in the big
picture cause to help understand why the PC I GSS requirements have
written the way that they are.
And I want you to imagine, for you own a small island.
And on the islands there are lots of diamonds.
However, around the island, there also lots of pirates.
You want to give the job of securing the diamonds from the pirates to a company.
And so you want to write standard that tells the company what they
have to do to stop the pirates stealing the diamonds.
We could call this the pirate Control initiative
Diamond Security standard or P C.
I.
D.
S s for short.
If the company guarding the diamonds follows the standard,
then the pirates won't be able to steal the diamonds.
So what would you put in such a standard?
When I asked this question of a group of security specialists,
they came up with suggestions such as build a fence
and put land mines on the beach.
Some people also suggested putting minds in the sea.
Others wanted searchlights on watchtowers.
One strange person suggestion.
We provide awareness training to the diamonds.
But let's just explore the first suggestion of building a fence.
And if we wrote in the standard bill defense What
the company guarding the island?
No, to build a small wooden fence like this,
or a two meter or six for high battle finds topped with razor wire.
So we have to be a bit more specific than just build a fence.
We could start with a simple build a fence to keep the pirates out
the control diamond environments requirement.
But they would have to say that the fence was pirate resistance,
that it completely encircled the CD and that because pirates are
known to dig holes that the fence was also buried,
a meter or three feet under the ground would assume also that
sometimes you might want to get inside the fence to look at your
diamonds so there'll be a door into the fence,
so we better specify some sort of pirate proof door.
But I'm sure, as you found out in your life, words can be misinterpreted.
So if we just say specify a pirate resistant offense,
people might have all sorts of ideas about what that means.
So we'd better help people by explaining it.
And in PC I terms.
We call the explanation a description of the intent of the requirements
which helps people understand what requirement means.
Of course, once a year,
we're going to send an auditor or necessity of the island to make
sure the diamonds are being properly protected.
So we don't need to define a set of test criteria for
every requirement that we defined.
So the ways we could make sure the fences pirate resistance,
barter, perhaps examine the fences.
Test certificate.
Stand behind the fence, holding a diamond, shouting Here, Mr Pirate, look.
A nice shiny diamond for you on validate.
It takes the pirate more than two hours to cut through the fence.
We could try cutting through the fence ourselves in the pen knife.
Deceive it last for a couple of hours on.
That would give us the assurance defense would do its job.
So to protect the diamonds,
we did the standard that included a number of requirements.
A description of the intent of the requirements help
people interpret what it means,
and a number of testing procedures to validate that requirement is in place on.
It won't surprise you to know that this is how PC idea says
the security standard is constructed.
So, for example,
requirements 6.4 point three specifies that life card numbers
shouldn't be used in test or development environments,
explains the intent behind the requirements.
And then how necessity can validate a requirement is in place.
And if we look at the rial Prentice standard,
you can see we have the requirements.
The guidance, describing the intent of the requirements on the testing procedure.
Actually, that's a bit small, So let's just zoom in on the requirement.
Okay, that's better.
Now we can actually read the requirement on the
guidance on the testing procedure.
And if we zoom in again just to the testing procedure,
we can see this is telling the assessor what they have to do to validate.
The requirement is in place in 6.4 point three a.
The assess as to both observe testing processes and speak with
people to make sure that certain procedures are in place and
apply these equally to both the test on the development
environments in 6.4 point three be.
The assessor has actually to look at the data to make sure
that life pounds are not in use in both the test environment
or the development environment