[Autogenerated] In addition to all those changes we've looked
at in the standard itself there are a couple of major changes
to how an assessor reports.
The result of an assessment.
You won't see these in the standard or in the
summary of changes to the standard.
Instead you need to look at the report and compliance and the attestation of
compliance documents and also the report on compliance.
All three of these documents are available from the PC
document library on the website.
The first new feature is at the level of the entire
assessment and that is that a report on compliance can now
be marked as a partial assessment.
The second is a new option that can be chosen by an assessor in respect
of each individual requirements and that is that the requirement can be
assessed as in place with remediation.
Let's look at the partial assessment first when completing the
reporting compliance and summarizing the results of an
assessment in the attestation of compliance,
the assessor has to mark whether it is a full
assessment or a partial assessment.
It's pretty self explanatory.
A full assessment means that the assessor has looked at every single Pc.
I.
DSS requirement.
If it's a partial assessment,
that means one or more requirements have not been looked at by the
assessor and they've been marked as not tested.
There are a few reasons why an organization might ask an
assessor to carry out a partial assessment.
Remember that in a partial assessment only a subset of pc.
IDs requirements have been tested by the assessor and every
other requirement in the standard would have been ignored by
the assessor and marked as not tested.
An organization may want to validate that some of the P C I.
D.
S s requirements are in place and just do this partial
assessment for for a number of different reasons.
Perhaps they're reporting to their acquirer progress
against the Pc IDs prioritized approach.
This could be because they're in the process of becoming compliant or
they're taking advantage of one of the card brands compliance programs that
only requires an organization to be compliant with,
let's say, the first two milestones of the prioritized approach.
It could also be that the organization has implemented some new technology,
Perhaps they've installed hardware security modules,
so they've changed the way they manage encryption and they
wanted an assessor just to validate that this new technology
meets the appropriate requirements.
It could also be that the organization only takes
responsibility for a subset of Pc DSS requirements.
And so this is all they want the assessor to look at.
This is very typical of a service provider.
For example,
the co location facility may only provide the physical security
requirements contained within principal requirement nine.
So it would ask and assess to validate these requirements are in place
but not look at anything else in the organization.
The concept of a partial assessment is not entirely new Assessors have
been able to do this and mark the requirements they didn't look at is
not tested in version three of the standard.
However,
it's not been possible to indicate this properly within the report on
compliance and the attestation of compliance with the ever increasing use
of outsourcing a third party service providers.
This is a useful change to the two reporting documents.
The designation of a single requirement as not being in place,
but as being in place with remediation is a completely new
concept in pc IDs version for so now,
when an assessor tests and assesses each Pc IDs requirement,
There are five possible results of their testing.
The requirement can lead to be marked as in place in
place with remediation not applicable,
not tested or not in place and not in place with remediation is entirely new.
It means that when the assessor tested the requirement, it was not in place.
However, during the course of the assessment,
the organization was able to rectify this and the assessor was able to validate
that the organization understood the cause of the failure,
that the requirement was now properly in place and that
the organization had put in place processes to prevent the
re occurrence of the failure.
So it's not just that the organization fix the problem.
In the course of the assessment,
the assessor has to be confident that the
organization knows why the control failed,
The organization properly put it right and the assessor was able
to validate the requirement was properly in place by following the
testing procedure in the standard,
the assessor also has to be comfortable that the organization put
in place the necessary processes to make sure the control of the
requirement wouldn't fail again.
As anyone who has been an assessor knows,
it's not uncommon to find requirements that are not in place when you
come to do an assessment and for the organization to put the
requirement right before you finish the assessment.
This new reporting option allows that to be recorded by the
assessor within the reporting compliance.
And it's also summarized in the attestation of compliance that some
requirements were marked this way as in place with remediation.
I guess the intention is to provide more transparency about the assessment.
Perhaps to management who have to sign off the attestation
of compliance may be intrigued to know that when the
assessor looked at a requirement,
it wasn't in place to begin with or perhaps the customers of a service provider,
we'll be able to see that having their annual assessment was
actually the reason the service provider notice to control or
a requirement was not in place.
And only then did they rectify the problem?
Examples of where in place with remediation might be used or if the
assessor found the organization being assessed has Not applied a
critical security patch within 30 days,
but the patch was applied before the end of the assessment or
perhaps looking at the training records,
they discovered that some users have missed out on
their annual awareness training, but then those users,
those people then received their training before the end of the assessment,
Maybe some new systems have been added to the cardholder data environment,
but they've not been correctly configured with anti malware software,
but then they were before the end of the assessment or perhaps
in confirming the scope of the assessment.
Some unencrypted panel was found in a surprising place and it
was deleted before the end of the assessment.
But I guess the most common use of this will be where one of
the required quarterly CSV scans was missed.
Traditionally,
assesses and organizations have fixed this problem by the
creative use of compensating controls,
which were really never intended by rectifying historical problems.
It'll be interesting to see how this new status is used by assessors
and how it's perceived by organizations being assessed and how it's
being perceived by their customers.
In the next module,
we're going to look at the new way that almost any
requirement can be assessed as in place,
which is by using the customized approach