Chris interview- review again and refine the notes.

 how would you scope on the auditor side of PCI DSS?

I need to see the inventory list. I need all your paperwork, all your policies. I believe working along with any network engineers will establish 

your environment, what is your segmentation look like.  a lot of business,

how are they goign to route all these services? any source, any destination. let's talk about. how are you securing this data? where is it at?

that is important. another that the coucil provides. you establish your levels, your milestone. all those results will come along.

what if the client does not store or process or transmit credit card data? how wold you 

or maybe they are a service provider?

who is your ASV. we need to know that to establish this assessment. the QSA will break it down. that AOC for you, we will establish, because you still have to make this extra research. we need to confirm that information.

Q: if you are the QSA

I will be soon.

If you are the QSA and the client says we don't touch credit card information. let's say they are the data center. our customer do (touch the cc data) but we don't what requirements do you see in scope?

if you are service provider, you are processing credit card holder data.

1.1.6 secure services and protocols.

you could say based on your business level, but you have to establish

Kyle: working right now with the GO group. are you 

A: internal team, in the region we don't work diffract it is a federal facility, we have a contract with immigration. occasionally we have cyber security meetings, we will implement 

Kyle: what are the biggest challenges in implementing DSS requirements?

how simple we understand PCI DSS requirements and how much system administrators don't. 

enclosed supervision and working together you will accomplish those goals. 

Q: what is your approach to the situation have you know more about this than the other people?

A: I just share my knowledge.

Q: what is your gap in knowledge when you 

A: pen test. 11.3 I want how your external pen test is coming along and how old it is. with those vulnerabilties were they remediated in the time frame it was supposed to.

it's too technical or we don't get paid for that. involve yourself more and lets talk about it. a lot of moments I see that