[Autogenerated] The second reason why organizations
failed to maintain their PC idea says compliance is that
they do not carry out the tasks.
That PC idea says specifies must be undertaken on a scheduled basis.
The standard is quite prescriptive in terms of what an
organization needs to do on a daily monthly,
quarterly six monthly and annual basis.
The scheduled tasks a written into the requirements,
also that for rising payment Security report has got a really useful summary
of what requirements need things doing on a regular basis.
I'm going to quickly go through those businesses usual
tasks specified in the standard, and it's part of the transition in tow.
Ongoing compliance.
Each of these tasks needs to be owned by someone.
Otherwise they probably won't happen on a daily basis.
The logs from critical systems need to be reviewed in any
exceptions or anomalies followed up.
There are actually no tasks that are prescribed,
which has to be undertaken on a monthly basis.
But if we look at requirement,
six critical systems has to be passed within 30
days of the patch being released,
which means that practically at least once a month,
new security vulnerabilities need to be evaluated according to requirements.
6.1 and patching needs to occur for critical systems
going to requirements 6.2 And so, although it's not specified in the standard,
most organizations will run a monthly patching triage process where
patches are evaluated and it's decided which one is going to be
applied and again isn't directly specified.
But requirement 12.8 point four requires that the organization
monitors the compliance of its service providers.
And the easiest way of doing this is to review the list of
service providers on a monthly basis,
work out which one's were approaching the end of the 12 month compliance and
then start proactively engaging with the service provider to make sure the
organization receives the service providers.
New at a station of compliance or, however,
is Theo validating the service providers compliance so that
that's done well in advance of that service.
Providers Compliance Expiring There are a number of quarterly tasks.
First Ian Requirement three.
There's a quarterly process for identifying and deleting stored.
Cut all the data that's being retained in excess of the
defined retention period Requirement.
Eight.
There's a demand to remove or desirable user accounts
that have been inactive for 90 days.
That's not really a course, the process.
But I thought I put it in here to remind you that this is
again a recurrent task that needs to be done.
The remaining quarterly tests,
or come from Requirement 11 wireless access points need to be detected.
Identified.
Andi inventoried on drove Wallace access points destroyed.
And then we have two requirements related to vulnerability.
Scanning.
Firstly, an internal vulnerability scanners required each quarter.
And the standard also requires the re mediation of any
vulnerabilities detected by that scab.
There's also the same two requirements to run scans on,
then re mediate for external vulnerability scans and these remember need to
be conducted by an approved scanning vendor or and SV.
And there's another coarsely task that many merchants will have to comply with.
Although it's not a direct requirement of PC,
Idea says,
because some of the card brands require merchants to send their coarsely
External SV vulnerability scans to their acquirer.
There's one scheduled task which needs to be carried out every six month,
and that is requirement 1.1 point seven,
which is to review the firewall rules of all firewalls that
could affect the security of the cut.
Hold the data environment.
Now we come to tasks that need to be done every year,
and it's quite a few of these from requirements.
Six.
We need to make sure that developers air training,
secure coding techniques, Um, ideally,
the latest vulnerabilities in frameworks that they're using.
Also, there's that very strange requirement.
6.6.
If we're not using a Web application firewall.
All Web facing applications need some sort of application vulnerability.
Security assessments from requirement nine.
We get two more annual tasks firstly,
to review the security of any locations where backup media restored and,
secondly,
to correlate the inventory of physical media containing cardholder data
with the actual physical media containing cut hold.
The data requirement 11 contains three annual requirements for
___________ testing an external ___________ test,
an internal ___________ test on a ___________ test of any controls that
segment in scope networks from out of scope networks.
And remember, it's not just doing the testing.
There's also the requirement to remediate any vulnerabilities
found by any of those three ___________ tests.
Requirement 12 wants us to review our security policy and
conduct a risk assessment annually, although personally,
I do this in the opposite order.
Do the risk assessment before the security policy because the policy
might need to be changed based on what we decided.
In the risk assessment.
There are two requirements specifically looking at human resources,
which is to make sure that everyone has got access to
the cardholder data environment.
Has their annual training about securing cartel the data on then the
requirement that they formally acknowledge that they have the
training and their security responsibilities.
Requirement 12.8 point four We talked about earlier.
Remember that requires us to monitor the service providers annual police.
The idea says compliance.
But as we discussed previously, we should do this every month to make sure.
But no service providers actually run out of compliance.
We only did it once a year.
South of service Bride would run out of compliance
cause we wouldn't have noticed.
And then the final task that needs to be completed once the year is
to review and test the incident response plan