I vaguely recall something about self-assessment questionnaires, but I can't remember if that's the CISO's responsibility or more for the business units.
I like option C - the CISO should ensure the internal scope validation is completed and that an assessment is done to discover all credit card data. That seems like a critical step in the process.
Okay, I think the key here is that the CISO needs to work closely with a QSA to determine the appropriate scope. The CISO can't just rely on the business units' suggestions alone.
Hmm, I'm not entirely sure about this one. The CISO's role in PCI scoping isn't something I'm super familiar with. I'll need to review the PCI requirements more closely.
Option B is the way to go. I mean, who else would you trust with scoping the PCI environment other than a QSA? The CISO is not a mind reader, you know.
Carey
6 months agoEmelda
6 months agoDorthy
6 months agoEdward
7 months agoJamal
7 months agoCiara
7 months agoEttie
7 months agoTony
7 months agoCorazon
8 months agoHaley
8 months agoCatalina
8 months agoNicolette
8 months agoLeonida
8 months agoHolley
1 year agoJulio
11 months agoSharmaine
11 months agoCarlee
11 months agoMee
1 year agoSol
1 year agoEttie
11 months agoLon
12 months agoAlline
1 year agoKayleigh
1 year agoJennifer
12 months agoGlynda
12 months agoNan
12 months agoAide
1 year agoMarla
1 year agoTiera
1 year agoJosue
1 year agoAnabel
1 year agoReuben
1 year ago