[Autogenerated] if in assessing marks of requirements being in place when
the assessor also needs to complete the reporting details.
And so the assessor has to record what they did to
fulfill the testing procedure, the Jacob explains.
There are three testing approaches in the DSS.
When you do an assessment,
the DSS says what you have to do to check that some
things in place or not in place, doesn't it?
Describes the way you do the tests.
So can he talk me through those tests?
The different test, the wrong.
Sure, they're usually kind of three.
Potential testing approaches, right?
One is look a tsum documentation on and describe what's in that documentation.
Does it describe the process?
Does it talk about what needs to happen?
Right?
And sometimes that's a policy or a procedure, right?
And sometimes that's some sort of documentary's output from some activity,
right?
Some ticketing or records keeping activity that that
results in the process being followed.
One is interviewing somebody, right?
Uh,
and sometimes these interviews flow sort of naturally from
the conversation we have along the way of tell me about what
it is you're doing right there.
Covering.
You know, some of those interview requirements.
And sometimes you have to ask very specific questions that that
feel a little sort of contrived or force.
But that's just so you can then cover those things
that are necessary in the interviews.
Okay, And then the third is observed something, right?
Find some tangible artifact, uh, of what it is they're doing.
And this, this may be, varies the most widely, This could be a log file.
This could be a configuration.
This could be, you know,
maybe some alert from a system or some sort of event data.
Uh, this could be the ___________ testing results of the scan results,
you know, Or this could also maybe be some documentary output from some process,
right.
But so you might say,
need to look up the group policy settings in active directory,
right?
How do you collect evidence?
You take a picture of the screen or, you know it can vary.
And generally we tell our clients like the medium is this
sort of less important than the content.
So if it's convenient for them to take screen pictures,
screen shots and post those image files for us,
sure.
Uh, you know, in some cases, we can output some of those things,
as as text files or pdf's or something like that.
Also.
Good.
Um, you know, in many cases, we want server configuration data.
We give them sort of a list of what we want,
and they'll script it up in whatever scripting is beneficial to them on then.
Very often, we get some text files.
Sort of zipped up.
Uh, with all of the output from that script, I'm not going to give you a script.
I'm not going to have you execute anything you know, on your systems.
But if you want to script that up Great,
Rob, you know, other sensors maybe will provide scripts.
And, you know, that's a business decision that assessor firms make.
But I don't want my hands on your environment.
Right?
As a necessity.
You never touch the plants.
Cabo.
I personally never touched the clients keyboards.
Okay, some assessors maybe do that.
Uh, yeah, right.
So you're typically sat next to somebody, You'll show me this right?
You will see it will take a screenshot of it.
You collect that is over.
Right?
But they can't just take the screen.
You can't do it over the phone and I just send the screenshot Well,
it usually I want some ability to make sure that the screenshot is is valid,
right, that they're not faking it.
Now there is increasingly sort of the case where even if I am on site,
you know the servers or somewhere else, right?
I'm in an office where I can talk to people.
Yeah, right, Because that's the purpose.
You know of that on site assessment because it's all in
Amazon or call in some cloud environment.
Uh, and so what's happening is they're logging into some system,
putting it up on a projector or putting it up on a large display
and then taking screenshots there right now,
Do I necessarily have more assurance that they're not
faking it in that situation than I do?
If we're doing it over some some Web sharing AC activity sometimes,
yes, sometimes no.
Right.
The PCD assesses for a long time, talked about needing an on site component,
and it does right, and by and large, that's usually what happens.
There is an increasing number of cases where I don't really know where to go,
and I don't really know what to do when I get there,
because everybody works remotely and everything lives in
the cloud or some provocation facility.
And even if I had an office,
I was going to go to I just go to the conference room and dial a phone
number and connect to a WebEx or something like that,
and everybody else would do that from wherever they live.
That that is more and more common, you know,
particularly among service providers.
And I struggle with, you know how to say,
Yeah, we went on site when you know I went to a conference room,
but sometimes you don't need to look in somebody's eyes to make sure,
But you're getting the whole picture.
Yeah, that is true, right?
So even if none of the systems air there,
if all of the I T people are all of the software
developers are in a particular spot, then sure,
I would buy a plane ticket and go there,
right?
That makes sense.
If everybody is diffuse, am I going to go to you know,
seven different people's homes and seven different cities
to go look them in the eye and say,
Are you lying to me about whether or not you do code reviews.
Yeah.
Um, that's a tough sell.
Okay,
so if we take a quick look back about testing
procedure for 6.4 point three point a,
we see that the assessing needs to look a process is an interview.
Personnel as they do this,
the assessor is going to be considering both the test
on the development environments.
The reporting instruction requires them to identify the people that they
interviewed on and describe the testing process that the observed for both the
testing environment on the development environments.
What an assessor completes the reporting compliance while typing the
identities of the people they interviewed on what the people said to
confirm the testing requirements in place.
This looks a bit strange because typically an assessor will list the
actual names of all the people they spoke with a spark their assessment
right at the beginning of the reporting compliance.
Then, when they want to reference that person in the description of evidence,
they just cover something like Person Sentinel Present 10 where
a testing procedure requires the assessor toe Observe something
the assessor would need to describe what they observed in the
reports finding section