In this episode of InfoSec Insider, Alastair Stewart and Tibor Laczko, both Senior Consultants and Qualified Security Assessors (QSAs) with URM, share their insights on complying with periodic requirements within the Payment Card Industry Data Security Standard (PCI DSS). Alastair and Tibor leverage nearly 30 years’ combined experience with the PCI DSS to discuss:  

• Why PCI DSS v4 moved away from fixed frequencies and towards risk-based intervals for some controls
• The common mistakes they see organisations make when defining their own frequencies
• Whether the introduction of Requirement 12.3.1 has improved security outcomes or simply increased documentation requirements
• How PCI DSS targeted risk analysis (TRA) differs from an enterprise risk assessment and why organisations frequently confuse the two
• How to determine appropriate activity frequency and the evidence that shows QSAs an organisation’s chosen frequency is reasonable
• How to meet specific requirements such as Periodic Evaluation of Systems Not Considered at Risk from Malware, Application and System Account Reviews, and Change and Tamper Detection Mechanisms
• And more.

Ask Alastair and Tibor a question: https://urmconsulting.com/podcasts/pci-dss-periodic-activities

If you enjoyed this episode of InfoSec Insider, you can leave us a rating and review here:  https://ratethispodcast.com/infosecinsider        

You can find more episodes of InfoSec Insider here:  https://urmconsulting.com/podcasts        

 Connect with us on LinkedIn

 Brought to you by URM, the UK’s leading information and cyber security specialists.   

In this episode of InfoSec Insider – Talk DP, Aimee Brown and Rachael Salter, both Consultants at URM, break down cookies compliance under the General Data Protection Regulation (GDPR) and Privacy and Electronic Communications Regulations (PECR). Aimee and Racheal draw on over 20 years’ combined data protection experience to discuss:

• Why cookies are so important to businesses commercially
• What the law actually requires when using cookies
• How businesses get cookie compliance wrong in practice
• Where consent or pay fits in
• What good compliance actually looks like.

Ask Rachael and Aimee a question: https://urmconsulting.com/podcasts/gdpr-cookies-compliance       

If you enjoyed this episode of InfoSec Insider, you can leave us a rating and review here:  https://ratethispodcast.com/infosecinsider        

You can find more episodes of InfoSec Insider here: https://urmconsulting.com/podcasts       

Connect with us on LinkedIn 

Brought to you by URM, the UK’s leading information and cyber security specialists.     

In this episode of InfoSec Insider, Neil Jones, Senior Consultant at URM, shares key advice and guidance on ISO 27001 Clause 10.2 (Nonconformity and corrective action), its requirements and how organisations can meet them. Neil leverages over 20 years of experience working with risk and information security-related standards to discuss:

• What Clause 10.2 is and why it is important for organisations managing problems with their information security management system (ISMS)
• What nonconformities are, and the difference between major and minor nonconformities
• The requirements of Clause 10.2 and how organisations can implement them in practice
• Common mistakes to avoid when addressing Clause 10.2.

Learn more about this topic: https://www.urmconsulting.com/blog/iso-27001-clause-10-2-nonconformity-and-corrective-action

If you enjoyed this episode of InfoSec Insider, you can leave us a rating and review here: https://ratethispodcast.com/infosecinsider      

You can find more episodes of InfoSec Insider here: https://urmconsulting.com/podcasts

Brought to you by URM, the UK’s leading information and cyber security specialists.