[Autogenerated] The assessor has to detail how they've carried out the
testing procedures for each PC ideas s requirements.
They do this in a document I've heard about before.
Called the report in Compliance.
And here you could see the section from the reporting
compliance for requirements 6.4 point three.
The first part of the report compliance just restates the
testing procedure taken from the standard.
Next,
the assessor has won five check boxes that they need to market
report on the status of that requirement and the five options they
have are the requirement is in place.
The assessor found evidence to support a statement that
the PC ideas s requirement was in place.
Secondly, the requirement is in place,
but it is in place with the use of compensating controls.
And we're going to look at compensating controls in just a couple of minutes.
Thirdly, that the assessor,
having looked at against his environment in the way
that they process payment card data,
confirmed that this requirement was not applicable to the entity.
The fourth options Actually strange one,
it's not tested, which means the Assessor didn't even look at the requirements.
They're not giving an opinion whether the requirement should have been in place,
which have not been in place.
They just didn't look at it.
An example of where you may come across this will be wear.
A merchant agreed with its acquirer that it just needed to comply with
milestones wall into in the prioritized approach.
And so the assessor only examined the requirements contained in
Milestones one and milestones to the privatized approach,
marking every other requirement as not tested.
The last option is the sad one.
The last option is not in place.
The assessor examined the entities environment,
and they could not find sufficient evidence to support
statement that the requirement was in place.
Let's say from Jacob on the difference between not
applicable and not test it when you do the assessment that
this there's two interesting columns, no applicable,
I'm not tested right.
They seem to create no end of confusion,
for for lots of different people sure can explain the difference
between the two absolutely not applicable means there's nothing
there to test in Requirement 2.1 point one,
where it talks about securing wireless networks in the environment.
If there are no such wireless and networks right.
If I don't have anything to test that's not applicable, Okay?
If there's no stored cardholder data than the requirements about
protecting it in storage are not applicable,
Right?
Right.
Not tested.
Means there's something there.
Right?
I did not test it, right?
Not tested.
It is kind of a variant of not in place.
Right?
Where?
Where Instead of saying I know this is noncompliant,
I'm saying I did not test it, so I cannot assert that it is.
So you're not forming an opinion?
Basically, yeah, I didn't look about I didn't look at that.
There's something there.
Yeah, there's something to be looked at.
There's something that maybe I should have in a more ideal scenario,
but for whatever reason, usually essentially a client request.
I didn't.
If you do something like a co location, which is usually just requirements,
19 requirement 12 often often is right.
Would you mark the other ones is not in place or sorry.
Not applicable or not tested?
We mark them is not tested because he would just asked to look at nine and 12.
You're not saying we agree that that's what we should look that right?
Yeah.
Okay, right way.
Well, what I'm not saying In doing so,
I'm not saying that Requirement six for applying patches to the
CCTV or the badge access system isn't relevant.
Yeah, I think it is relevant, but I didn't look at me.
Look at it.
All right, OK.
And that's actually important when you're reviewing service provider
rocks to see what was tested on what was not tested.
Exactly what was put in scope of what?
Our scope, right?