The last requirement is to have those policies and procedures that commit the
organization to comply with the amounts of requirement 4,
and that means the policies and procedures are written down,
they're accessible to everyone who needs to use them,
and most importantly, they are actually used by people.
The QSA is going to check each of those three things,
that the policies are there, that they're accessible,
and that the people who should be using the policies and
the procedures are doing just that.
Now let's join the conversation between Jacob and me
where we discuss PCI DSS requirement 4,
and especially ways of using TLS and encrypting data
in transit on internal networks.