[Autogenerated] if managing control, decay and taking care of all.
Both scheduled task was not enough to maintain RPC idea, says compliance.
We also need to control and manage change because change is what
breaks PC Idea says complies most frequently.
And this is one reason I'm so passionate about having the
smallest cardholder data environment possible,
because then it will be subject to the least amount of change.
There are three types of change that can really affect PC idea,
says Compliance Andi.
That can affect the security of cardholder data business changes such as
changes to the way that payments are processed or new exceptions.
Channels were being opened changes to physical locations
such as retail stores and offices, and changes to the corporate environment,
including mergers and acquisitions.
Because PC I DSS is concerned with people,
processes and technology people change is a really important,
and that could be changes to people with responsibilities for managing
technology or changes to people who have specific PC idea,
says responsibilities.
And then, of course, there is the standard starters,
movers, levers,
processes to think about as users changed their roles and leave the
company throughout the course of a year and then finally,
the change that you'd expect to have the most effects
on the cardholder data environment, which is technology changes,
changes to systems, changes to networks and really,
at the moment that continued migration of in house
systems into cloud environments.
There's a special category of change defining PC idea set,
which is a significant change.
Significant changes things like adding new technology to the cuddle,
the data environment, major upgrades,
the hardware and software changes to the way that cut all the data is
processed or flows through the cardholder data environment.
Anything that changes the boundary of the cardholder data environment,
irrespective of whether that's a change that results in an
increase or a decrease to the size of the CD eight,
any changes to the infrastructure supporting the
cardholder data environment and finally,
any changes to third party service providers.
Some of the scheduled PC idea says requirements we
looked earlier also specify that,
as well as doing things a scheduled time that the
requirement has to be fulfilled again.
If there's been a significant change in the environment.
A really good example.
This is ___________ testing,
which has to be done annually or after a significant change.
So, just as we did for the schedule tasks,
I'm gonna go through this standard and highlight which requirements
need to be considered when there's been a change.
Firstly, network changes.
The standard itself requires all network changes to be documented,
approved in tested.
He also wants a network diagram, and any cardholder data flows to be updated.
And if you change any of the protocols,
services or ports used within the cardholder data environment,
the documentation relating to that needs to be updated as well.
If the change in the network was significant, P.
C.
I.
D.
S s also requires internal and external vulnerability.
Scans and ___________ tests now build standards.
Changes to build standards require approval and again,
if they're significant, changes both internal and external.
Vulnerability,
scares and ___________ says against the new approved
build standards in requirement three.
Any changes the data retention policies need to be approved by
management and also in requirement three.
If the organization's stores encrypted cardholder data,
there are quite a few requirements consumed with changes to
encryption keys and changes of key custodians.
PC Idea says, of course,
does contain some pretty prescriptive change management
controls in requirements 6.4 point five.
All changes to the cardholder data environment will be
expected to follow these processes.
An assessor would also expect to see an evaluation of each
change to see whether it was significant.
And it's so evidence that PC idea sis's requirements in that respect,
we followed thinking about access management now in requirements.
Seven.
There's a need for changes to access rights within the CD to be
approved by management and in requirement,
ate.
The creation of new user accounts also needs to be approved by managements,
where changes are made to cardholder data stored on physical media,
for example, moving it from one location to another.
This is going to require manager approval and also the
media logs and the infantry's updating.
As people join the organization, change roles will leave.
There are a number of PC ideas s requirements affected.
If a key custodian leaves the organization,
they need to be replaced on then the new key custodians
added to the register requirements.
78 Both have task to be fulfilled in respect of access rights.
When people change.
When you users start, they require screening.
Before they joined the organization and training when they actually start
on the last people related change to think about is whether anyone who
leaves the organization was one of those people who fails one of the
required rolls defined in requirement 12.5.
And it's so that responsibility needs to be reassigned to somebody else.
When service provides the change,
the register of service providers needs updating and the
organization must make sure it's followed.
Is documented processes to engage a new service provider
finally thinking about business changes,
The risk assessment security policy should be updated and reviewed,
and perhaps the specific people responsibilities Detail in 12.5
also could be looked at again on personally.
And this isn't a requirement of PC ideas s.
It's just my recommendation, I strongly recommend.
But after any significant business change,
the incident response plan is checked and tested