Compliance Unfiltered is TCT’s tell-it-like-it is podcast, dedicated to making compliance suck less. It’s a fresh, raw, uncut alternative for anyone who needs honest, reliable, compliance expertise with a sprinkling of personality.
Show Notes: PCI Engagement Masterclass
Quick Take
On this week’s Compliance Unfiltered, PCI engagement chaos doesn’t have to be the norm. Todd Coshow and Adam Goslin explore how smarter compliance workflows can eliminate repetitive evidence collection, QA bottlenecks, and annual audit scrambles.
Learn how request lists, automated evidence mapping, and operational mode streamline PCI and multi-framework compliance while reducing human error.
From year-round evidence collection to better assessor workflows, discover how the right platform and processes can save time, improve accountability, and make complex compliance engagements far less painful.
Read The Transcript
So let’s face it, managing compliance sucks. It’s complicated, it’s so hard to keep organized, and it requires a ton of expertise in order to survive the entire process.
Welcome to Compliance Unfiltered, a podcast dedicated to making compliance suck less. Now, here’s your host, Todd Coshow with Adam Goslin.
Todd Coshow:
Well, welcome in to another edition of Compliance Unfiltered. I’m Todd Coshow, alongside the Mrs. Fields to your compliance chocolate chip cookies, Mr. Adam Goslin. How the heck are you, sir?
Adam Goslin:
Oh, man, I can almost smell them.
No, I’m doing good, Todd. How about yourself?
Todd Coshow:
I can’t complain, sir. I truly can’t.
Adam Goslin:
Well, I tell you what, I’ll jump in for the friendly reminder for the listeners. One, appreciate you guys joining us for the extravaganza. Been at this for a week or three.
The one thing that I would ask is certainly follow us on platforms of choice. Throw us a review. That would be outstanding.
And do me a favor. I’m seeing a lot of movement in terms of people in the compliance arena. Everybody’s gotta be making new friends, know friends that they’ve got, people that would be interested in hearing what we’ve got to say, all of that fun stuff.
So don’t be shy. Go ahead and let people know that we’re out there, we’re here to help, all of that fun stuff.
And what was that? It was like the “more you know” style commercials back in the day. It was like, “And they tell two friends, and they tell two friends.” I forget what the hell it was about. I didn’t wanna speculate, but I have a feeling it was something about STDs or something back in the day.
Anyway, let’s not get into that, but do me a favor, tell a couple friends. That’d be great.
Todd Coshow:
Most definitely. Well, switching gears here quickly, today, good sir, we are going to talk about PCI engagement masterclass.
Now, I have to ask, why did this topic speak to you, Adam?
Adam Goslin:
Well, we’re heading toward that time of year where we’re all gonna be heading over to the PCI community meetings, both in the US and the EU.
The reality is a lot of people that are in the compliance arena, a lot of them tend to use a kind of rinse-and-repeat style approach.
It’s almost like you get into your lane, right? I got my thing, and I do it this way, and I’ve always done it that way. For some of these organizations, “We have always done this this way since the dawn of time.”
It’s cool to have a good, rock-solid process you can depend on, right? But in the same sense, I made this company to help people.
I love helping people. I love making their lives better, giving them solutions that’ll actually help, all of that fun stuff.
So we wanted to take the opportunity to go through some of the advanced capabilities that few assessors are really leveraging to their fullest capability.
Hopefully, even if you’re a seasoned Compliance Unfiltered listener, I’d suggest thinking about your process, how you do what you do, some of the stuff we’re gonna bring up, where it could be applicable, and hopefully this particular session turns out to be helpful.
Todd Coshow:
Absolutely. Well, let’s start with telling the listeners more about request lists and some of the benefits when handling multiple certifications.
Adam Goslin:
Sure thing.
I’m sorry, I got completely distracted by a shiny object.
I went and did a quick lookup. “And they tell two friends, and so on.” It was not an STD, fans that are keeping score.
It was a famous phrase from 1970s and ‘80s television commercials for Faberge Organics shampoo. So for those of you keeping score on Adam’s memory card, you can put the red mark on that side of the paper, shall we say.
Anyway, sorry, I’m back now.
Todd Coshow:
So request lists.
Adam Goslin:
Yes, request lists.
A lot of people tend to walk into this notion of the request list as, “My engagements aren’t all that challenging. They’re not all that difficult, so I don’t need a request list. I really only need my request list for these super complicated engagements, etc., and we don’t have engagements like that, so we’re not gonna bother.”
But the reality is, I challenge the listeners to just think about it.
Actually, now that I think of this, I’ll give a pro tip on this one too.
When you go in and do an engagement on the TCT portal, for those that haven’t really inspected what happens, you can hit the full export button, and that will produce kind of a full export of the entire track, all the report texts, explanations, which attachments went where.
One of the files that comes out of that is like a document spreadsheet. Basically, what it is, it’s a unique list of the documents that were leveraged on the engagement, and in the next column over, it tells you how many places was that document used.
As a test, I would just suggest go do that for one of your recent engagements. Go look at that file because what you’re gonna see is that there are single pieces of evidence that are attached to multiple requirements, and in some cases, the evidence is attached to hundreds of items.
The one that typically falls into that category are the documents that were leveraged for the overall information security policy. That could be on 150, 180 different items, right?
Todd Coshow:
Yeah.
Adam Goslin:
But you’ve got the same thing just on a smaller scale with simple stuff like the documentation of how the firewall rules should be set up, the network diagram or data flow diagram, the list of the third-party service providers, or how often you used a particular AOC for a third-party service provider and where all you attached it.
There’s a billion examples when you’re on one of these engagements, right?
It’s not just the holy moly uber engagement where you can use that request list.
If you look at just the amount of duplication you’ve got on even a standard engagement, you’ve got a lot of opportunity for streamlining, for making things better, for making things easier.
The one thing that organizations don’t really think about is when you’re using that request list, it’s one of the biggest game changers. This is where you are able to tell the control owners exactly what it is that you want.
You don’t have to leverage the language that comes off of your PCI ROC, as an example, which oftentimes isn’t written in the easiest way for the control owners to understand what the heck is it we need to do here.
You can put the request in your own language. You can put the request in terms that your clients will understand. You can tell them whatever you want about it. You can give guidance. You can give examples, etc.
So you’ve got a ton of options on that request list just to make your client’s life easier.
Ask for something once, and then go ahead and use the request list mappings so that all of that evidence automatically falls into the right destination location.
Instead of attaching, and I’ll go back to that worst-case scenario of the information security policy, instead of attaching that to 150 to 180 items manually, I just say, “Hey, give me your overall information security policy,” and they go ahead and attach it, and poof, everything shows up on the 150 to 180.
Todd Coshow:
Well, I was just gonna ask, how much time do you anticipate that saving, not over the course of one engagement, but over the course of a year, given your business?
Adam Goslin:
Yeah. It’s gonna save an organization an absolute ton of time because it may not be your time. It might be your client’s time, right?
Or whatever poor soul has to go in and do the attachments.
The other thing that’s another ancillary benefit of the notion of the request list, and this is one of the things that drives QA teams absolutely effing nuts, is we know that this item always needs to have blah, blah, blah attached to it.
If I’m doing it manually, then human error is gonna come into the mix, and sure enough, somebody’s gonna forget what to put where.
This also helps and streamlines, let’s say you got noobs on the team, right? I had somebody that just came from another organization. They’re new to us and our ways.
You don’t need to worry anymore about are they gonna remember all the rules and regulations and guidelines and flip to page 87 in the procedure manual.
They just go in and attach the thing in the right spot, and blam, it lands in the right spot.
Whether they’re folks that have been on your team for a decade or they’re folks that have been on your team for two weeks, all they have to do is attach the right things to the right spots on the request list, and bam, everything consistently shows up in the right spots at the destination.
It’s not just saving time and sanity of control owners. It’s not just saving time and sanity of the assessors, but it’s also saving the time and sanity of the QA team because they now can depend on, “Hey, I know all the stuff that landed into this item got mapped to the right location.”
They don’t need to worry about, “Did the right stuff land into the right spot?” So they can now just focus in on, “Did I get the right stuff?”
It ends up working out really, really well there.
A lot of customers will leverage that request list. This is kind of what I would suggest: use the request list for churning through the “Is this right?”
So your workflow that you’d normally have, right? The control owner passes it up to the assessor. The assessor passes to QA. QA goes to complete, that type of a deal.
In the request list, that’s where you are looking at: Did they give me the right evidence? Does it contain everything that it needed to? Did they miss something? They were supposed to put five things on here, they only put four, whatever.
All of that kind of back and forth of the “Did we get the right stuff?” you do that over on the request list side.
Because everything’s flowing through and dropping into your destination track, whether it’s a ROC or a SAC or whatever, then you can use that destination cert for PCI to go through and finalize reporting.
A lot of times what I’ll see is I’ll see them work through the “Do we have the right stuff?” and work the request list through to complete on the request list side of the fence.
But on the secondary track, the assessor and the QA team can basically be working on the report text and making sure they got the right things written down and the right notes and things along those lines.
What I’ll typically see is the control owners are attached to the request list, and that will flow to the assessor. That flows into a completed state.
Then on the PCI track, it’ll start in the assessor’s hands where they’ll formulate up all of the report text, hand that over to QA, and that flows to complete, that type of a deal.
As you’re going through that process, that way the control owners just need to worry about the request list, make sure they have the right stuff, and then just use the secondary one for reporting.
As it relates to the request list and where there’s multiple destination certs, let’s say that I’m doing a PCI with a HIPAA with an ISO 27001.
There’s a couple of different things that I’ll see used.
One is, let’s say the request list started off with PCI. What they’ll do is they’ll take, as they say, “You know what? We want to expand this request list and add in the HIPAA and the ISO 27001 elements.”
I’ll see them take that request list and add in any of the control elements from the additional certs and their associated mappings into that existing list that they’ve got.
That would be kind of my recommendation. I’ll explain more about that in a minute.
But in other cases, what I’ve seen is an organization will use kind of a prescriptive cert as their starting point, and then from there what they’ll do is they’ll map the right things to the right destinations and handle leftovers on the destination cert.
Let’s say that on a PCI engagement, they don’t really handle to the depth needed the handling of backups. Do I have enough backups? The right number or quantity of dailies and weeklies and monthlies and quarterlies and annuals, whatever.
In PCI’s case, they care about whether or not the backups are encrypted if they have sensitive data in them, not that you have an appropriate quantity or number or structure of those.
Where ISO is going to get into a greater level of depth around the capability to be able to come back from certain cases that may face the organization, and that may be the reason I need a weekly or a monthly or a quarterly backup, that type of a thing.
Anything that’s showing up on your ISO track that isn’t necessarily completely covered under PCI, they’ll just handle that on the ISO track so that all the stuff from the request list maps in, they handle the leftovers there.
Since the TCT portal has the capability to have control owners configured with EasyCert, that’s just, for those that aren’t aware, a really simplistic, easy-to-use interface for loading evidence.
It’s easier on the control owners to just leverage that same request list for everything that they’re doing.
It just makes things standardized, makes things easier on them.
The cool part for the organization that’s leveraging the request list is that they can have tags on the control items which indicate the control groupings or the applicability to the resultant certifications and standards so that the org can use the same request list for all of their engagements.
If I’ve got one organization that’s doing PCI standalone, another organization that’s doing HIPAA standalone, I got another organization that’s doing ISO and HIPAA, another one that’s doing PCI and ISO, etc.
If I just have the same request list, now that I’ve got the control items tagged by cert, I could for one client just turn on the stuff for PCI. In another client’s case, I could turn on everything that relates to PCI and ISO.
It allows you to mix and match off the single request list to just activate the appropriate controls based on the engagement that we’re going through.
This just builds standardization across all your engagements and consolidates the organizational configuration.
I love using that KISS principle, if you will.
Todd Coshow:
That’s massive. That’s just such a time savings, and then it just eliminates so much of the shenanigans that go on when you have employee turnover.
It’s just when the process is the process and everybody knows the process, it makes a significant difference.
Adam Goslin:
Well, and when you’re using the same damn thing across all your engagements, holy crap, does that make it easier?
I can’t tell you how many organizations, it’s almost like silos, right?
We got the PCI group, but then I don’t know which group thinks the other group is the red-headed stepchildren, but you got PCI over here and you got SOC over here. I think both of them think the other one is the red-headed stepchild.
It’s like these silos within the organization.
PCI and SOC kind of built from different worlds, if you will. But even the HIPAA, the PCI to the HIPAA or ISO group, depending on the organization, I’ve seen a lot more siloing that will occur within those organizations.
It’s cool when you can see the organization able to center around one thing and be able to use that interchangeably on their engagements regardless of the direction.
It’s just fun.
Finally, one of the main benefits of that dance between the request lists and the destination certs, for the organization that’s going up against these multiple standards and the target organization has multiple assessors, your firm may only be handling PCI.
Or maybe the client is in a position where they need to handle with one assessor the PCI engagement, and with another assessor their ISO engagement, as an example.
When we set these things up, it’s really easy in TCT to go ahead and configure the right control elements landing into the correct hands so that the PCI assessor’s only seeing their PCI track with its results, and the ISO group is only seeing their ISO track, etc.
It’s easy for us to control who should see what, the right stuff’s landing in the right spots, all of that fun stuff.
And just for the record, for everybody listening, all the stuff that we’re talking about, this isn’t some new functionality that just rolled hot off the press last week.
This is stuff that we’ve had in the platform. It’s up, it’s running, it’s live, it’s active, it’s in production.
This is all functionality that’s literally ready to be leveraged.
Todd Coshow:
No doubt. So with all that said, that kind of leads to the next big topic, right?
The capabilities for the TCT portal to support complex engagements through requirement splitting. Tell us more about that.
Adam Goslin:
Oftentimes on engagement, there’s a whole ton of reasons why somebody needs to split items, and I’ll get more into that in a minute.
But the one thing that’s critical to understand is that this capability is possible.
It doesn’t matter whether you’re using EasyCert, a request list, a standard track in TCT. Requirement splitting, we can do that wherever.
Coming back to reasons for splitting, organizations could have some really fundamental reasons why they need to split items.
Some examples would be they have multiple in-scope locations.
I’m in a position where I need to gather up evidence of, let’s just use physical security. I need to go in and gather up camera evidence from multiple physical locations.
I could have a client that has multiple applications that are in scope, so as I’m going in and grabbing evidence of the use of secure transfer or authentication mechanisms, etc., I need to be able to collect that up against application one, two, three, four, and five.
It could be that it’s a service provider, and the service provider has multiple services that they can join into a single engagement, right?
So I need to make sure that I’ve covered the control elements for service A, service B, service C, things along those lines.
Those are some of the big reasons for splitting, but what a lot of people gloss over is that there’s often reasons for splitting items at a more granular level, and this happens on almost every damn engagement.
I have multiple operating systems, so I’m rocking both Windows and I’m rocking Linux.
I’ve got multiple firewalls. I’ve got Fortinets and I’ve got some WatchGuards out there.
I’ve got multiple model numbers of POS and POI devices with different evidence I need to go gather up on each of those.
I have maybe multiple vendors that we need to collect up control evidence on as I’m going down the controls.
These are things that happen on damn near every engagement, right?
Let’s just use a simple example of needing to collect up the information across multiple operating systems.
One of the huge problems, I chuckle as I say this, and only because I can’t tell you how many times I’ve watched this unfold.
One of the biggest problems on the complicated engagements, you’ve got a single control, but now we’re running both Windows and Linux, and we need to load up evidence for both.
Of course, the groups for administering those platforms are different, right? The Linux people aren’t administering the Windows platforms and vice versa. Different skill sets, different capabilities, whatever.
What ends up happening, despite the fact that you’ve told them, “Oh, by the way, we need to get the evidence for both the Linux group and the Windows group on here.”
You can tell them that all you want, but the reality is that the Windows group goes in, they attach their evidence. What do they do? Boom. They hit the complete button.
They’re completely forgetting that we have the Linux thing. “I’m done with my stuff, so I’m gonna mark it complete.”
Of course, it moves up the food chain.
The group that receives the control review goes, “Oh, God. They didn’t put the Linux stuff on there.”
So what do they do? They go ahead and reject it back down.
The Windows crew goes back in and says, “Hey, we already did this.” Boom, they hit the complete button and move it back up.
Just cue the effing circus music as you’re watching in the history on the TCT portal what’s going on.
I literally should have circus music that just automatically starts playing in the background whenever this happens. I personally think it’d be funny as hell, but that’s just me.
There’s a ton of manual intervention that needs to happen with this and too much dependency on the capability for humans to make mistakes.
That lack of specificity at line-item level also means I don’t have any idea who the hell actually needs to do something.
Let’s say that on this control it was the Linux group that attached their stuff, but I’m waiting on Windows. And on this control it’s the Windows group that attached their stuff, and I’m waiting on the Linux group.
I don’t have a damn idea.
Now I gotta go in, look at the open item and manually review the evidence, just try to figure out who the hell needs to do something?
This is a manual process. Humans are invariably gonna screw it up. You’re wasting time all the way around.
The TCT portal has the capability to split along any divisional line, engagement by engagement.
This isn’t something you have to do generically on all my engagements are gonna be split on Windows and Linux, right?
If this specific client has multiple operating systems, split it on it. If this one doesn’t, don’t.
That way, once we’ve gone through and done all the appropriate splits on the engagement, now I have precise knowledge of the state of each control split by split.
Now I’m not wasting time, and I have absolute accountability and clarity on this engagement.
I know the compliance folks are listening to angels singing right now because, for those that haven’t leveraged some of these high-end features that I’ve been talking about, they are literally game changers on engagements.
They’re a really big deal.
Todd Coshow:
Finally, Adam, tell us more about why to use operational mode.
Adam Goslin:
When you’re on an engagement, and this is once I’ve gotten past my first cycle with the target organization, once I’ve gotten past that point and we’re now stepping into year two, I’m gonna call it year two plus, right?
When I get to year two plus, now I’ve got obligations to do things at certain points throughout the year.
Just easy examples, right? I need to go in and do my quarterly user reviews. I need to do quarterly vulnerability scans, whatever it may be.
But when you use operational mode, what you’re doing is you’re able to take this single control, split it out into its appropriate parts and pieces.
If it’s a quarterly control, then I can split it into quarters, and I can have separately running due dates that will run throughout the compliance cycle, all of it auto-calculated.
It will then serve up to the team, “Hey, it’s time to load up your compliance Q1 vulnerability scan. Hey, it’s time to load up your semi-annual part one firewall review,” as an example.
It’ll give you the capability to automate that, but that allows the spreading of this evidence all the way through the cycle.
It gives you the ability to make sure I get the right stuff at the right time, the complete capability to customize all of the collection timing, assignments, things along those lines.
For the clients, it makes them feel like they’re actually in control of their program rather than the tidal wave of the program washing over them.
The other side of it is for the assessor.
I can’t tell you how much better it makes the assessors feel when they know, “I’m getting what I need, I’m getting it when I need it, I can keep my eyeball on things. I don’t get to the end of my engagement and it’s a crap show.”
There’s a lot of real material benefits for embracing the operational mode side.
It gives you that much better sense that clients are doing their job. They’re keeping up with their responsibilities.
That tends to make the assessors feel really good, right?
There’s always this when you walk into the annual engagement, right, where, “Well, we haven’t touched base with each other in 10 months, and it’s time for the annual engagement again.”
That’s often walked into with some measure of trepidation because you’re like, “Oh, God. What am I gonna run into this time?”
When you’re doing this in operational mode, you don’t have that.
You can walk in knowing that the organization’s been keeping up on their stuff, and long story short, everybody is happier.
The other kind of fringe benefit here is that I’ve seen assessment firms that are able to draw a line of distinction between assessment service levels.
This one client just wants to keep doing the annual circus, that type of a deal.
Great. Leave them there.
But for other clients where we can turn them on in that operational mode, they can have a much more high-touch service for their clients.
They can also have the capability to charge them a premium for that measure of assurance that this new program is bringing to the table.
They’re able to charge a premium to those clients, which is helpful for the assessment crew and the clients feeling the love at the same time.
Todd Coshow:
No doubt. Parting shots and thoughts for the folks this week, Adam?
Adam Goslin:
Well, if you can’t tell, we got a lot of stuff and capabilities within the TCT portal.
We’ve been at this for north of a decade.
Do me a favor. Reach out to the TCT portal support group.
If you’re new to TCT, hit us up on the web, whatever. We’d love to help you with learning about ways to optimize your use of the portal.
We’re always here to help and to save you guys time, and brain cells for that matter.
I want you to keep in mind that, for numerous organizations, TCT also has the capability to put together engagements where we are working with and continuously collaborating at a deeper level with organizations to help them operationally get the most out of their TCT portal capabilities and assisting them in bringing their programs up to the next level.
The one thing that we’ll hear a lot from target organizations is they’re so embroiled in what they’re doing day by day, they just don’t have the time to put into the continuous improvement or evolution of their programs.
That’s an arena where I almost call it a great synergy between the subject matter experts at the target organization with the subject matter experts from TCT, so we can take the best of both of those worlds so that we can help people make sure that their programs are taking those next steps and headed in the right direction.
Ultimately, everybody’s happier.
Todd Coshow:
And that right there, that’s the good stuff.
Well, that’s all the time we have for this episode of Compliance Unfiltered. I’m Todd Coshow.
Adam Goslin:
And I’m Adam Goslin.
Hope we helped to get you fired up to make your compliance suck less.
