[Autogenerated] a PC idea says compliant environment will
be damaged by the three headed monster control decay
scheduled tasks being ignored and, most importantly,
change and the only way I know to prevent this three
headed beast from destroying our PC idea says compliance
is to make embedding PC Idea says, into business as usual,
a part of the objective of the original PC idea says Compliance program.
Let me explain what I mean by that.
A program typically starts off with the objective of making
an organization PC Idea says Compliance.
Lots of work happens, perhaps over many years.
And then at some stage, the organization is ready for its first assessment.
The assessor will come in, and then typically,
after a couple of months, the organization will receive its first PC I DSS,
reporting compliance.
Everyone will be really happy the project or program was a success,
and the team will go out and have a celebration of local restaurants,
and after that, the team will disperse.
Contractors will leave, internal resources,
will move on to new projects or go back to the original roles and the
ongoing responsibility for PC ideas as compliance.
If it's thought about all will be thrown over a wall,
typically to someone or a team with an I T.
That may not have been expecting it.
You shall have to absorb the extra work in with their existing day job.
And that's where our three headed, compliance destroying beast will eat away.
Our PC idea says compliance.
Which is why, when it's time for the second assessment,
the SS, if ized that many requirements are not in place,
yes,
perhaps as much as a 35% gap between the requirements that should be in
place and the requirements that actually are in place.
And it's not untypical for a second PC I project or programme to be needed.
But there is a better way of doing it,
and this is perhaps the best piece of advice I give to an organization.
Let me say that again.
This is the most valuable lesson I have learned in over
10 years of being involved with PC.
Idea says.
A successful PC idea says Complies project or a program ends after the
second reporting compliance he received not the first Let's see how this
looks So just as before the programme starts.
Only this time the end of the program is not the first assessment,
but the end of the second PC idea says assessment.
And again,
they were going to be a number of years of hard work that lead up to that first
assessment on the organization's first reporting compliance.
It's OK still, for everyone to go out and celebrate,
because this first rock is a major success,
but it only represents the end of the first phase of the program.
After everyone's come back from the restaurant,
the second phase of the program starts.
It'll probably need a much smaller team,
but it's still a continuation off the PC idea says Compliance program.
We haven't yet declared success,
and the aim in this second year is to ensure that all the
requirements that the organization is decided need to be run at
maturity level of four run at that level,
that the schedule tasks of being done, that someone owns them,
that there is a robust change management,
so that involves putting in the necessary responsibilities,
accountability processes,
operational effectiveness measures and monitoring systems to make sure the
requirements in place and doing their job every day.
And when an organization does this and of rigorously manages change.
The second assessment is typically as easy as the first assessment.
There's going to be a small gap because not every requirement will make
the grade that the assessors looking after there will be a really small
gap and then the assessments finished.
The second report Compliance has received the project or
programme can justifiably go for a very large celebration
before the team disperses.
Leaving PCO Business is usual,
complies integrated within the organization and that's where successes.
There are just two more observations I'd like to make about maintaining
compliance before we hear from Assessor Jacob Ansari.
The first is related to PC Idea says compliance in Business
Continuity It is common for organizations,
tohave,
standby equipment and facilities on predetermined procedures that they will
adopt in the event of the briskness continuity events happening.
It's important to consider that these systems are not part of the card,
all the data environment because there's no cardholder data being stored,
processed or transmitted in them.
However,
that doesn't mean you shouldn't consider them as part of your wider PC idea,
says Scope,
because it's important to consider PCR GSS requirements and where possible,
build these business continuity environments to be compliant with the standard.
Because once you are in a business continuity event,
these standby environments will bury quickly,
become card all the data environments.
So as soon as the organization's stabilized and this move to a business
continuity environment represents a significant change,
you should undertake a full gap assessment against PC,
Idea says, and start any re mediation.
Remember, cyber criminals are opportunists,
and they will always take advantage often organizations weak points.
Being in a business continuity event is an invitation for the
criminals to come and attack your cardholder data.
My second observation, you might consider strange,
but I've seen many organizations reluctant to change the
scope of their cardholder data environment once they've
gotten environment assesses compliance,
Even if it's obvious that sustaining this level of PC idea says
compliance is really incredibly hard for the organization.
To maintain so seriously is fine.
To use the tools and techniques we discovered in the scoping and segmentation
module to change in established cuddle the data environments.
It's almost as if having made a decision about what the CD would be,
organizations feel they have to live with that decision for eternity,
whereas it's often much more sensible to change the CD if maintaining
compliance isn't working on a smaller CD is what's needed now.
Let's join Jacob one final time,
where he discusses the problems that he most commonly sees with PC
ideas as sustainability and on organizations.
Second PC Idea says assessment