[Autogenerated] now differences of opinion you have with clients.
I guess that Ham's occasionally once or twice.
I've often that difference of opinion with Q essays.
I have my own particular way of resolving them right,
which which I don't talk about.
Well, actually, no.
I will tell you what I do.
So what I do is, I always say, to accuse,
say that by having a difference of opinion is show me where it says that in
writing in the standard in an f a Q or A council document.
Right?
So so so prove to me what you're saying is true, right?
You're saying that needs to It happened that way.
I'm saying, Okay,
show me where the is and the reason I do that is I found
lots of people make up the standard.
Sure, they think it's good security.
Therefore, they make clients do it.
Okay,
so that's my 1st 1 What do you do when when you
have a disagreeing with a client.
So there there's sort of a continuum off that sort of show me
where it says that right to your point.
There are assessors who maybe don't know right or making
things up or are misreading things or, you know,
whatever they're doing erroneously to say You need to do this thing where
maybe you shouldn't and then you push back and say,
Where does it say I have to do that right?
That's a fair question.
Sometimes the answer is you're not going to get it to say in those exact words.
Yeah, you have to do this thing right, But you say Okay,
I look at what's in the standard and I look at what the intent of the
requirement is based out of the guidance based out of some of the
information supplements based out of the FAA.
Cues basically glossary even,
and I construct my argument for why I think you need to do this right.
And if your assessor can't do that, you know that's worrisome.
But I'll give you an example.
The multi factor authentication thing with Ssh yeah, right.
So we talked earlier that we don't think ssh keys
are multi factor authentication.
The client argue with me and say, You know,
I think that password is an authenticating factor,
and I said, OK,
let's go look in the glossary and the glossary talks about
authentication as verifying the identity of the user.
And I'm saying that password does not verify the identity with the destination.
With the server, the ssh key does right.
But that is just one factor.
The password that protects the ssh key does not.
Right.
So does it say it in those exact words?
No.
I mean,
you have to sort of read the law and the prophets and then kind
of put the pieces together in many cases,
right?
It's standards.
Language is never gonna It's not always going to be able to
address your particular circumstance, right?
That's not the point.
But that's why there are assessors.
Yeah, right.
And that's why there is, you know, the corpus of information that there is.
You can put those pieces together and, you know,
make the position that here's what I think you need to do based on yeah,
you know, this this sound reasoning in your own firm.
Do you actually talk about amongst the assesses where
sometimes on the client pushes back?
What we used to do was just, like sense.
Check it between ourselves, ask us sure that we do that routinely, right?
And if it's contentious, I mean,
just one of the basic kind of client service techniques is just a de escalate.
You know, some of that tension before it gets acrimonious and say,
You know what?
Fine.
Uh, let's let me go back to my team.
Let me shop this with my team, uh, and make sure that I'm not spouting nonsense.
Yeah, right.
And that this is the argument that we're seeing consistently applied.
This is what we're hearing as guidance from the brands with council,
you know, And that allows sort of both sides of take a step back from something,
Andi, consider it right.
And then we agree on, you know, the next meet to discuss.
So from my perspective,
having works both as an assess around as someone who gets
assessed when those things happened,
I always make sure we record them in writing.
So whatever we agree when we do agree something,
always make sure I get it written down on the USA
agrees that that's what they've agreed, right?
So that when it comes back in a year's time,
I don't have the same discussion again because the
USA is now left back us a firm.
I've got a different cue essay on site from the same firm.
Sure on what I'm after is the firm's opinion, not US.
Eyes opinion, right?
Well, and I think that's helpful.
To commit to that and writing right to be able to say This is what we
agreed on I would say I would say What you want to do is here is kind of
the rationale right here is the full bit,
right?
If it's just, you know, if I If I follow along,
if I'm that second assessor, right and the client says,
Well, you know, the last person that was here from your firm agreed to this.
Oh, really?
Yeah.
Uh, and there's It's sort of short of its context and it's just well,
they agreed to it,
and now you are bound by whatever this person said that
you didn't have any control over.
You know that's not great.
And that is potentially sort of adversely impacting my ability to
act with independent judgment should right.
But if you can say here's the reasoning for our position that we agreed Teoh,
right then we could evaluate that on its may look OK,
that was what we agreed.
You know at that point in time, here's the judgment for that.
Here's the rationale for that.
You know, if the circumstances air so similar.
Yeah, that's one of those things.
The merchant is quite terrible, actually.
Is if you get because you hire a firm, you don't don't gonna hire a cure.
So you hire 1/3 right on you get the QS on site and
they agree something with you.
And then the next year, the same firm, a different USA says no,
that's actually in scoping out of scope,
right?
That could be a really expensive UN decision to make a decision to be unmade.
Which is why I always insist that for anything like that, you get it.
Get it in writing because that's the firm's opinion, right?
And that also means to cure Site is going to take it to their
boss and say the rest is to put that in writing.
We okay doing that right Well, and that's helpful, right?
If the boss right is involved in that assessment at at least some capacity,
right then even if the sort of trenches qs leaves the firm and you get somebody
else or you just get somebody else because of scheduling.
Whatever.
Right.
You have some continuity.
Absolutely.
And when you know when you're a senior, enough assessor, right?
Part of your job is acting as that continuity point amongst kind of the staff.
Que essa, right?
Uh and yes.
Oh,
they should come to the senior people and say this is what
the client wants us to agree to in writing,
you know, let's make sure we're all on board with that,
right?
I said the other side of that coin is sometimes it seems like Oh,
the assessor has changed their stance.
You know, things are different this year.
Not cool.
Uh, but what's actually happened is the circumstances have changed, right?
And sometimes, you know,
the merchant environment or the client environment has changed,
right?
And so that precipitates a change in position.
Sometimes the threat landscape has changed right on.
And that feels, I think,
more arbitrary if you're the assessed entity and you feel
like you're getting the bait and switch,
right, like, oh, the threat landscape has changed,
right?
That's a convenient sort of excuse, But again,
the assessor should be able to justify, you know,
with some data with some news with something about Hey,
we're seeing these kinds of attacks.
I would expect many assesses did not include third party sites
that had Java script that were loaded into the payment page in
the scope of an assessment last year.
I'm gonna bet quite a lot them change their opinion after the
last few JavaScript attacks that actually,
that's probably in scope.
Now the answer will be to stop loading stuff into the payment page, right?
Not to put right not to get a rock from anyone
that's giving you jobs with right.
But I think that I think things like that you're absolutely right.
The threat landscape changes about how how that's communicated,
right is the cool right?
And so every when you're in a situation where the client wants this in writing,
I think I think the, um,
you know it's incumbent on sort of all parties to make sure they really,
really understand what's happening.
Because sometimes the answer is, Hey,
I said something different than I said last year
because this year I know better.
Yeah, right.
Like if you don't, I tell you your assessors.
I tell myself this when you know I need to when I go look at
the rocks that I wrote a year or two ago.
If I don't look at those and go God, I can't believe I said that.
Then I haven't gotten better right, and that's a problem.