[Autogenerated] now Jacob are organizations comply?
Were into business is usual, right?
What's going to go wrong and knocked me out of compliance.
Really sustainability for for so many controls,
there's a need to provide effort right to keep working at what
the control entails to continue to review logs,
to continue to fix vulnerabilities,
tohave sort of functional process that informs essentially
how the organization needs to operate right or at least
put securing the environment, securing the payment data,
you know,
in a seat at the table about sort of the management of the organization.
And so if you're doing PC ideas s compliance to sort
of tick a box or to make it an I t.
Problem that that the leadership doesn't want to engage with or to
make the fewest number of change is possible,
then Year two is probably going to be sort of rough as you find that
things sort of broke under the strain of kind of the indifference of the
organization or just that the needs of work at it,
Yeah,
and not really committing those resource is One thing I often see
is a great project to become PC idea says compliant There's a whole
project team that some contractors,
everyone's running for this sort of compliance get compliance.
All those people leave rate on.
Then there's no one holding the PC.
Idea says Compliance, baby, Right,
How do you is a curious I How do you How do you help
your organization not do that?
Well,
part of it is is getting you preparing for the end of the
project and then translating that from Project into it into
its amore sort of routine operations.
And again, sustainability is a big sort of notion behind making that work.
How do you make sure that if if those contractors or those other people that
came in specifically for this project are rolling off are leaving are going
back to whatever it was they were doing beforehand?
Who's picking up those responsibilities?
How do we make sure this stuff continues to happen, right?
If we had to sort of blood in the database,
add men's into letting us patch the database so it wasn't
running someone supported version right?
Who's going to bludgeon the DVDs again in a month when there is a heap
of new vulnerabilities to be fixed on the systems uh,
Or maybe better yet,
how do you persuade them that this is actually a good idea and,
you know, obviate the need for bludgeoning?
Um, you know, I think I think you see a lot of cases where there's a lot of,
like, personal heroics amongst a few kind of key people.
Teoh, get over the finish line of you have compliance, right?
But you know,
you can't You can't build a sustainable business model on the personal
heroics of somebody that you know very desperately,
probably wants to go lie down for a few hours thereafter.
So that, to me, is almost like a failure in a sense that it took,
you know, somebody's, you know,
assiduous efforts above and beyond what what you know was
reasonable for them to compensate for, in the end,
the lack of leadership in the organization.
So one thing I always try and do if the client will allow it to happen,
is Teoh contract with a Q s, a thumb to do what I call interim many assessments.
So, in your first year of compliance,
I want the Q S A to come back after a couple of months,
four months six months, eight months on.
Just come and sample some controls.
The controls that I know from reading.
Well, from experience of reading the Verizon reports,
the ones that people get wrong.
Do you do that?
Secure Siphon.
Would you be open for doing that?
Sometimes I've been I've been sort of trying to consider how to make
this of a sustainable service idea for a long time.
Right?
How do we How do we do some intermediate check ins, right?
For some sample of requirements in such a way that if maybe the
client passes all those little health checks along the way that
there's some benefit to them, you know, in the in the validation.
Right.
I feel like there would be conceivably some benefit for us if I can say,
Yeah, this is working as advertised.
You know, the next year is gonna run more smoothly, right?
You know,
then maybe I can budget a little bit less for for
the time and effort spent on that.
Yeah.
I mean,
what I found is a city in organizations where they don't have a
assessment and compliance history where they're not used to someone
coming in and checking our work that it really helps focus the
organization the first time when they go,
Well, I just looked up.
Six change control tickets on their all incomplete, right?
But I've caught that two months into the DSS lifecycle.
I'm not most nine or 10 for the first reassessment.
I found that that there actually is something that the that the
helps do the embedding into be a you because the head of the
service delivery team has Suddenly you got a problem that they
didn't actually understand.
They have that problem, right?
I find that that in some cases, in a lot of cases with our clients,
that kind of the opposite thing happens because many of our clients
also get other kinds of audits to get an essay 18 sock to where they
get a nice to 27 Neville Owen auto.
And so they feel like they're constantly being audited.
Right?
And they get this sort of fatigue from that where you know Hey,
I already provided a bunch of change tickets to the ice.
A team that was here a few months ago.
Why am I doing this again?
Well, yeah, different requirements, right?
Or you know why?
Why do I have to show you this patch management history?
When?
You know, somebody already asked me about that earlier this year.
Well, you know, has been a long time, right?
I can't rely on stuff.
That was six months ago.
Uh, and so that's tough, right?
Uh, where?
Yeah, You want to embed the sort of business as usual?
You know, maybe by doing more frequent examinations, right?
But it's absolutely possible toe sort of do enough
examinations that you sort of burn everybody out.
And they feel like they're always, you know,
trying to work with somebody standing over their shoulder,
auditing them, wanting to see what they're doing,
needing to collect evidence and supply that to somebody for something,
you know, all the time.
And, yeah, I can understand how that would get tiresome.
Jovan Answer for how the U get over.
That's a tough one, I think.
I think there's, ah sort of a right kind of measure somewhere in the middle on,
then Obviously, you know,
for our for where we do a bunch of different kinds of audits.
Uh, the the thing that we can do in many cases,
is very assiduous amount of planning to say,
How do we structure our timing structure or requests to?
You know, it's a leverage as much as we can across these different things,
right?
If your requesting policies for a sock one can I use the
same policy documents for my purposes, right.
If I'm requesting a bunch of change tickets for PC idea assess,
you know, then when my colleagues and I are so practice,
come along a little later.
Can I just give them those work papers and say, Here you go right.
And sometimes the answer is yes.
And sometimes the answer is no on sometimes our scopes are divergent and
sometimes our timing just doesn't work where that could happen.
But obviously,
managing those expectations with our clients and then
planning appropriately is how we do that Kuhm.