[Autogenerated] we reaching the end of our journey to become compliant
with PC ideas s because now we've reached the assessment phase and I'm
making an assumption here that we go to have a formal assessment using
an external assessor rather just completing our own self assessment
question there.
So here's what the process looks like.
Process.
It will come in execute or testing procedures and document the
evidence is we just discovered in the previous module They will then
prepare the initial draft report on compliance which will have some
of those not in place boxes text.
So we will need to do some minor fixing.
Ben,
the assessor will come back and check those areas where we need you to do that.
Remediation.
Once the remediation work has been checked,
we'll get our final report on compliance.
Most organizations will use a que essa, a qualified security assessor,
to conduct that assessment.
But it is possible,
based on brand rules that you can also use in the Internal
Security assessor or I s A And if that's the case,
the I s I has to be independent from the parts of the organization that
designed installed or which run maintain the requirements,
so that's something typically like the internal
audit function in an organization.
If you're going to use an IRS,
say you should check with whoever it is that's asking to be complied with.
PC Idea says that the independence of your essays okay with them the secret of
a stress free on good PC ideas s assessment is preparation.
You're going to be sitting with the assessor for probably a few days,
and it's Jacob said The assessor isn't going to
physically touch any of your systems.
You and your colleagues will have to show them the
evidence that they need to see.
So the first thing you need is to find a quiet space where you and the
assessor will be able to work without being disturbed.
It was recommend you set up a computer system with
two monitors or with a projector,
a large screen so the assessor doesn't have to look over your shoulder.
The assessor will probably ask you to make screen captures,
as you show them evidence within your system so that
they've got the evidence to take away.
So you need somewhere on your network where you can save those
screen captures and then send them to the assessor.
Afterwards, the assessor may ask for certain documents to be printed out,
so you need to make sure that the system you're using comprende
and you might think this is really obvious.
But there's been countless assessments I've been involved in.
We're getting a print out.
Seemed to be the most impossible thing that the organization could do.
The assessor will want to interview a number of people,
each requirement, whether testing procedure,
says Interview.
The assessor definitely needs to speak with
somebody before the assessor arrives.
You need to make sure that all the interviews will be available when
the assesses on site and that they won't be on leave or on a
training course or just not in the office.
There are many static documents the assessor will need to review it frequently.
You can send these in advance of the assessment so the assess,
a coworker of documents before they come on site but also gives them the
advantage was starting to understand your systems,
your processes and your networks and how your business runs.
So that will mean that there much quicker when they get on site,
because they have worked out how you're different from
the other companies they've assessed.
Finally, you want to agree a day by day schedule with the assessor.
Who are they going to me?
What evidence they're going to look out?
Which requirement going to cover on which day?
Because not only will you have to show them evidence on the screen,
but you'll need other specialists in your organization to be able to
lock into systems that only they have access to so they can show the
assessor the evidence that's required.
So a day by day session by session is really essential being a PC.
Ideas s Que essa could be quite a hard job because they spend a
lot of time away from home there in clients,
officers doing the assessments,
then writing them up and then just moving on to the next assessment.
So I'd like to talk briefly about how you can make it easy for the Q essay,
which actually means the Q S.
A will make it easy for you because typically,
a que essa is going to have a certain number of
days allocated to your assessment.
They'll have sometimes allocated to be on site with you
and the remainder for writing up.
Your most important job is to make sure the assessor can gather all the
evidence they need in the number of days that they have on site.
Because que essa is typically have a number of
assessments to complete in the move,
and yours will not be the only assessment they're doing.
Other ones will be scheduled and will be pretty immovable.
So if they can't get the evidence while they're on site with you,
they may not have spare days in their scheduled to come back for a few weeks.
And I know it sounds like a cliche, but if you fail to prepare for assessment,
you must be prepared to fail in having it delivered when you need it.
I've worked with some organizations who almost took pride
in making it really hard for the assess.
Its do that job.
This isn't a recommended strategy.
You can see the testing procedure in the evidence required with in the standard.
It's your responsibility to make sure that you're able to
show the assessor the evidence they need.
I don't Finally please remember there assesses.
Actually, people, they have good days and they have bad days and is the client.
You could do lots to make sure that day spent in your assessment of good days.
One of the most important things you can do to make sure that it
assesses time spent on your assessment of good days is to ensure
that all the people they're scheduled to meet turn up on time that
they're engaged in helpful,
that they're able to lock into the systems that they need to like.
They know the user name of password and have the security token
if they need a security token so that I can show the assess it
the information that's required.
I've always made sure before any assessment that I get the corporation of a
very senior manager toe emphasize toe everyone in the organization who will be
involved in the assessment how important it is to support the assessment by
turning up on time with the right attitude,
able to do the things they need to do and able to show the
access of the information required after spending some time on
site with you collecting the evidence,
the assessor will undoubtedly return to their office to
write up the report on compliance.
Even if you've gone through that remediation face first,
it would be unusual for all the requirements to be
able to march in place straightaway.
And so you may have some more work to do before the assessor comes back
on site again to test those remaining requirements that they were not
able to Marcus in place on their first visit.
Guidance from the counselor from most assessors is that a
requirement assessed within the last three months doesn't have to
be reassessed is part of single assessment.
So if the remediation you need to do will take more than three months,
you may need to book a complete second assessment.
And that's something to discuss with the assessor as soon
as you think you might be a possibility.
Throughout this course, I've talked about obtaining a report on compliance,
but actually you get to documents at the end of your assessment,
you get the report on compliance, which,
as we've seen,
is a detailed report on the evidence that the assessor was able to
collect to determine they could say required was in place.
Report.
Complies will contain a lot of confidential
information about your systems and networks.
It's not something you generally share.
So in addition to the reporting compliance,
you also receive an attestation of compliance.
The attestation is a shelter document.
It described your environment and it summarizes the compliance
status of the 12 high level PC ideas s requirements.
This at the station is also the formal document that the assessor on the
executive from the organization being assessed will both sign.
And typically is this attestation compliance that's provided as
evidence to whoever is this asking you to comply with PC?
Idea says So.
If you're a merchant, that's what you give your acquirer.
It is now time to join Jacob.
I'm sorry where he talks about the assessment process from assesses perspective.