Here are some situations that QSAs encounter way too often.
- Organizations that conduct their annual penetration test 30 days before the deadline to file their self-assessment questionnaire (SAQ) or Report On Compliance (ROC).
- Organizations that conduct their final quarter vulnerability scan 30 days before the deadline to file their SAQ or ROC.
- Organizations that decide to implement a compensating control worksheet (CCW) within 30 days before the deadline to file their SAQ or ROC.
Why are these situations a problem?
For the first two conditions, it is because if any of these results in a remediation effort, you either (a) have to remediate the findings and retest before filing your SAQ/ROC or (b) you have to put compensating controls in place and test those to ensure you are mitigating the risk of not remediating. Both of these situations can easily result in missing an organization’s compliance filing date.
For any…
View original post 418 more words
oogenhand 