There's no way they're too admin intensive to do them on the fly.

yeah you have to develop the control then they need to develop the control they need to explain to you what their control is and then the qsa needs to derive the testing procedure as they see fit to validate the control that the organization put in place so it's not documented in standard there's no testing procedures written for it so this is not something again when you know you're not like day four in the assessment and there's something that's not there, it's like, oh, you know what, let's just do a customized validation.

Yeah, no, it's not going to work.

Plus, I think, yeah, and I don't know about you, but like I've run into this a couple of times, well, even ahead of the assessment.

But then when you explain to the client how much extra effort is required to do a customized validation, they sort of like shy away from it.

So that's also probably why it's not used as often because most organizations probably aren't risk mature enough to be able to do

these kinds of things.

Although this is one of those things, I think it's important for us to point out that both composite controls and customized validation controls needs to be revisited every year.

Yeah.

Now you need to do your targeted risk analysis.

However, I don't know.

It's-- So in previous versions, it was, like, the overall risk management of an organization, and it, and now it's very focused on the targeted risk analysis or the customized approach validation.

So I think it did kind of like th- the council went away from, okay, so we're not looking at the enterprise as a whole.

Uh, we're looking at certain controls, which, to be honest with you, if the question is whether it improved security, I think it's kind of went-

Um-

Yeah.

So you kind of have to audit them essentially to the requirements

in question.

You need to pull them into your assessment or your client's assessment.

So when you, you can, you know, tell them that you need to become PCR compliant.

Well, you can, but I guess it depends on how big of a business it is that the service provider provides for you, but are they willing to go through it? But if not, I have a client right now.

Their hosting provider is not PCI compliant, but they're very happy to be involved in the assessment.

So they're made time aside through the gap analysis portion of the assessment or the engagement.

Yeah, I

So it's understanding that you can split the responsibility across the environment to make it a shared responsibility.

Well, a responsibility matrix should be either the clients, the service provider, or shared.

My general advice to my clients always is, if it's your responsibility, you don't really have to say anything.

If you deem that it's your client's responsibility, explain why you believe it's your client's responsibility.

And if it's shared, especially then, be able to draw a line because this is how much I do, but anything on top of it is your responsibility.

This is what I see most often from responsibility matrices.

And especially, I mean, I'm not calling out any of, I wouldn't dare calling out any of the large cloud providers, but when one responsibility matrix is used for 225 products, it's difficult sometimes to understand.

Speed is key when it comes to responding to incidents.

Yeah.

Uh, no servers, no physical devices.

So your provider runs the platform, you run the code on it.

But I think where when it comes to serverless, um, at least what I see, is sometimes they think no servers, no responsibility.

That doesn't mean that.

Like, um, the customer still needs to run their code.

They n- still need to, um...

Mm-hmm