The title of this post sounds like the start of one of those bad jokes involving the changing of light bulbs. But this is a serious issue for all organizations because, in today’s regulatory environment, it can be a free for all of audit after audit after assessment after assessment. A never ending cascade of interruptions to their business operations as they go through audits and assessments, all in the name of ensuring controls are designed and functioning properly.
But another reason I have written this post is because of all of the comments that I have received that seem to paint my position as a reason why QSAs are not needed to conduct PCI DSS assessments. I wanted to clarify for everyone my rationale for my position.
Besides those reasons, the larger reason this issue needs to be brought up and discussed is that the PCI SSC is pushing for organizations to adopt business as usual (BAU). For those of you that did not read the preamble of the PCI DSS v3, BAU is the integration of relevant portions of the PCI DSS into an organization’s everyday activities. A rather noble goal and only a recommendation at this time, one has to believe that BAU will at some point become part of the PCI DSS in a future version.
Any organization that takes the time to implement BAU is going to want to assess their implementation of BAU. They will do this through internal/external audit activities, automated real-time monitoring via dashboards and other internal assessment processes. Why bother with BAU if you are not going to use it to spot control issues before they become major problems? That is, after all, the whole point of BAU.
Which brings me back to this year’s Community Meeting and the question I asked about reliance on other auditor’s/assessor’s work. The reason for the question is to minimize, as best we can, the disruptive effects of the myriad of audits/assessments that some organizations are required to submit. The answer provided by the Council was an emphatic “NO!” followed by some backtracking after the audience apparently showed its displeasure to the Council members on stage to their take it or leave it answer.
The reason for the audiences’ displeasure though is genuine. A lot of organizations question the number of times user management controls such as identification of generic UIDs, last password change date, last logon date and the like need to be performed before such activities are deemed adequate? How many times do facilities people need to be interrupted to prove that video monitoring is performed and the video is retained? How many times do facilities have to be visited and reviewed for physical access controls? There are numerous areas in all control assessment programs where those programs cover the same ground in varying levels of detail and focus. It is these areas of commonality where the most pain is felt and we hear the lament, “Why do I have to keep covering this ground over and over with every new auditor that comes through?”
It is not like the PCI DSS cornered the market on control assessments. Organizations have to comply with ISO, HIPAA, GLBA, FISMA, NIST and a whole host of other security and privacy control audits or assessments. All of these audits/assessments share certain common controls for user management, physical security, facilities management, etc. What differentiates the programs is the focus of what they are trying to protect.
One easy approach to address this situation is to combine audit/assessment meetings with personnel in physical security, facilities management, user management and the like. Each auditor/assessor can ask their specific questions and gather evidence and conduct testing as they need. Unfortunately, due to timing of reporting requirements, having common meetings might not always be possible.
But another approach would be to use internal auditors performing testing monthly, quarterly, etc. and then the QSA reviewing those results during their annual PCI assessment process. There might be some independent testing required by the QSA for areas such as device configurations, change control and application development changes, but the sample sizes of any testing could be greatly reduced because of the testing done throughout the year due to the implementation of BAU.
If we as QSAs work with other auditors/assessors and agree to common criteria in our respective work programs that satisfy our common controls then we will not have to interrupt an organization to ask the same questions and alienate people as we do today.
Success of compliance programs is the result of making them as unintrusive and automatic as possible. BAU is a great idea, but it will only succeed if the Council understands how BAU will be implemented in the real world and then adjusts their compliance programs and assessment approach to take BAU into account. The quickest way to kill BAU is to make it painful and cumbersome which the Council is doing very effectively at the moment.
PCI Guru 