[Autogenerated] you may be wondering if maintaining PC Idea says compliance
is so hard but so important why the PC I SSC has not created requirements
to maintain compliance within the standard?
Well, if you turn to the back of the standard in Appendix A three,
you will find those requirements in a section that's
misleadingly called the designated entities Supplemental
Validation or D E S V requirements.
The DSV appeared as a separate document when PC Idea says
Version three was released and it was incorporated into
the standard in version 3.2.
It would be better named Things Entities Must Do to maintain PC
Idea says compliance between annual assessments.
It's not part of the main standard,
and entities who want to achieve PCR DSS compliance do not need
to meet the requirements contained in the D.
E S V.
I suspect at some stage it was going to be part of PC, Idea says.
But the car brands looked at that and decided all would be such a
big change that they weren't going to make it.
So.
These requirements have been left is a separate or optional extra.
So the beginning of the DSV it makes it clear that this
appendix is only applicable to entities designated by payment
brands or an acquirer is requiring additional validation of
existing PC ideas s requirements,
the type of entities that could be required to comply
with the DSV there entity's processing,
large volumes of card all the data or entities that have
significant aggregation points of cardholder data or
organizations that have previously been compromised.
It had an account data compromise where criminals stole their count.
All the data.
If the requirements in the D.
E S V apply to you, the car brands will tell you,
you don't have to sort of guess that they might apply to you.
And as far as I know,
there are no card brands that have applied the requirements toe any
organization to comply with the D S of a although I do know that if you
decide to voluntarily comply with it is a service provider.
One of the car brands will publicize this in their listing of service providers.
Any organization can't decide that it would like to comply with the
requirements in the DSV because they represent assessable.
Good practice for rigorous business is usual compliance.
The DSV includes requirements that are needed to properly maintain
ongoing and continuous PC ideas as complies,
is split into five separate requirements,
which are to implement a formal compliance program to document and have
ongoing validation of an organization's PC ideas.
A scope to properly validate that PCR GSS is incorporated into business is usual
activities to validate controls around logical access to cardholder data and
finally to detect and respond to suspicious events.
The DSP just looks like the rest of PC ideas s.
There's a requirement,
a testing procedure and guidance relating to the requirement.
I'm not going to run through all the testing procedures,
but let's take a quick look at all of the requirements I say a quick look.
But I see the requirements are much more wordy than many of the
standard PC idea says compliance requirements.
I'm not going to just released requirement.
I'm just going to summarize the key points on the first requirement.
A 3.1 is to implement a PC idea, says compliance program.
There are four sub requirements on the first of these is for management to
define responsibility and accountability for both the protection of
cardholder later on for the operation of the PC I.
D.
S s compliance program.
This includes having a formal charter to maintain PC idea says compliance in
the organization and then providing visibility of the state of compliance to
executive management until the board of directors,
the second sub requirement wants a formal compliance program.
And this basically puts into place almost everything we've talked about
in this module which your activities to effectively manage the
requirements that level for movement level of maturity and to ensure
that the schedule tests are completed and to analyse business change as
it affects PC idea theft.
With this program in place,
the next requirement wants to make sure that people have been given
specific responsibility for making sure that the program happens on
the final sub requirement here is to make sure those people have
been given that responsibility, has to be trained in PC,
idea says, and receive training on an annual basis.
The next requirement in the DSV is to make sure that an
entity scope is correctly defining Documented.
This is because many data breaches have come from areas of organizations
that were considered out with scope but which magically acquired cardholder
data after the formal PC idea says assessments.
The requirement is that scope is validated on a quarterly
basis and after significant change,
it should be formally documented and that documentation must include an
inventory of all in scope and all out of scope networks and systems.
The documentation must also include a description of any
segmentation of controls on a revalidation of all third parties
with access to the cardholder data environments wherever there
are chased the systems or networks,
but has to be a more formal process to document the
impact of the chase of the CD,
which needs to be formally signed off by responsible personnel and then,
after a change,
all of the requirements that we looked at a respective network
and system changes need to be put in place.
Essentially,
all this requirement is asking for is to make sure that any new system and
networks are brought up to PC Idea says compliance immediately,
and that this is documented requirement.
A 3.2 point three is concerned with significant business change,
such as acquisitions or mergers for key personnel changes,
and this is broadly in line with what we discussed earlier about the
requirements that need to be considered when this business change.
The next requirement just increases the frequency of requirement 11.3
point four in the any technical controls that are used to segment an
outlet scope network from an in scope network.
The ___________ tested every six months rather than every year.
Because many data breaches have been related to cardholder
data that was outside of the cardholder data environment
requirement a 3.2 point five.
What's a technical data discovery to or a methodology to
reconfirm scope on a quarterly basis?
Dr.
Proactively looking for clear text cardholder data outside of
the cardholder data environments practically.
To implement this,
you'd need to install a data discovery tool or an agent on
just about every system in the organization.
This sub requirement has a couple of its own sub sub requirements,
the first of which is to validate the method used to detect a plain text.
Cardholder Data is actually effective,
so that would require some sort of assurance activity where no _____
plane takes Cardinal Data's put outside the CD.
When you validate tool detects it.
If plaintiffs cut all the data is for real,
discovered outside of the C V eight that needs to be an incident
response processes initiated to both secure this data and work out how
it got there in the first place as well as detecting stored cardholder
data outside of the CD requirement, a 3.2 point six effective.
He wants data leakage prevention technology
installed at the bounty of the cuddle,
the data environment to detect and prevent clear text pounds
from leaving the cardholder data environment.
Personally,
I think this is a dumb requirement because any criminal would encrypt
cardholder data before trying to exfiltrate it from the CD A.
There is a subset requirement here,
which is that if the data leakage prevention technology does
detail plain text primary account numbers leaving the CD
which of course it will never do,
because a criminal would encrypt the data before exhilarating
it that the entity has a response procedure.
The third requirement in the D.
E.
S V is to make sure that PC I DSS is incorporated
into business as usual activities.
If I was in charge of writing these requirements,
it would have been called make sure were all requirements
operated maturity level for because the first requirement is that
critical security controls are monitored.
So if they start working fast detectives straightaway and you won't be
surprised to see that there's a sub requirement here that specifies what needs
to happen once you detected the failure of a control,
which is to make the control start working again,
work out why it failed in the first place,
and put in the necessary controls and processes to
prevent the control flaming again.
Requirement.
A 3.3 point two is a very interesting requirement because
you might have noticed that PC Idea says,
does not say anywhere but support systems,
applications or technologies cannot be used,
and even the DSV does not quite go this far.
But what it does require is that every year the organization
looks at the hardware software it is using and formally
determines whether it's still fit for purpose.
Whether it still can continue to meet PC Idea says his requirements and if no,
have a plan to replace that technology.
The finals of requirement of a 3.3 It's pride formal
assurance by way of at least a quarterly review.
The All PC idea says the B A U activities are being followed.
So this is something that Internal order or an I s A for a formal
assurance function would have to carry out.
The fourth requirement of the DSV is concerned with logical
access to the cardholder data environments,
and it just wants there to be a formal six monthly review of all user
accounts and their associated rights within the CD.
This is a fairly common requirement of financial services organisations,
but user accessed assistant and data is re certified on a regular basis.
On the last sub requirement of the DSV is to make sure the organization is pro,
actively looking for suspicious events,
rather just responding to alerts and without saying it in a Zeman E words,
it basically requires the organization to install a security
information and event management or a scene platform.
And so,
to sum up the supplemental validation requirements with designated entities,
it takes a lot of work to comply with these
requirements and in most organisations,
it would require a dedicated assurance function.
The bottom line is that the organization would end up
managing all the PC ideas s requirements,
the maturity level four.
They would not be controlled decay.
All the schedule tests would happen on time,
and change would be rigorously managed.
However, compliance with the DSP will be costly,
and I want to re emphasize this is Noah compulsory part of standard.
You don't have to comply with it unless you're specifically
asked to buy a car brand or by your acquirer.
However, any organization can use some or all of the requirements,
has a guy toe, have to embed PC idea says fully in their organizations,
and then use the testing procedures to validate this Personally,
I would not be surprised if some of these requirements do not end up being
put into the main requirements in the next version of PC,
Idea says.
We've reached the end of this module and therefore the end of this course,
and they really want to finish with six key point that will help you to be
successful in achieving and maintaining PC Idea says compliance.
Perhaps the most important point is it is always more important to
be secure than it is to be compliance Focus.
I'm not letting criminals steal the cardholder data you're
responsible for before you start any compliance journey.
It's really important to understand who is asking you to comply with
PC idea assessed and why they are asking this,
because that will let you know what the destination is.
You're trying to arrive, er,
how you're going to be asked to validate your compliance on
who you're going to give that validation to.
My personal advice is to always design your systems and scope of
cardholder data environment to do his little PC idea says,
as you possibly can,
because maintaining PC Idea says compliance is hard and expensive on
will restrict your organization's ability to be agile.
Perhaps the most important lesson I've learned in 10
years of working with PC Idea says,
is that the transition from a compliance program to
businesses usual is really hard,
and the best way of succeeding is to have the destination of your PC.
Idea says Compliance Program is your second formal PC ideas This
assessment not your first formal PC ideas as assessments and finally
recognize that alongside control decay,
andan organizations complete inability to carry out
the scheduled tasks required by PC, idea says.
But uncontrolled change will destroy your heart.
Obtained PC idea says Compliance.
If you have any questions about achieving and maintaining PC Idea says
compliance than the discussion Tub is waiting for you.
If you're wondering which course to take next,
then please let me recommend the discussion I had with
experienced PC I forensic investigator Aaron Willis,
where you learn about how criminal still Kartal the data and
discover what actually happens in the course of a PC.
I forensic investigation.
And I hope that by achieving and maintaining PC Idea says
compliance that this next course is the closest you will ever
get to a PC I forensic investigator.