Re: We hit half-million: The Cidr Report

[Valdis.Kletnieks () vt edu]

On Wed, 30 Apr 2014 15:40:43 -0000, Jamie Bowden said:

> You're not funny.  And if you're not joking, you're wrong.  We just went over
> this on this very list two weeks ago.

And in that discussion, we ascertained that what the PCI standard actually
says, and what you need to do in order to get unclued boneheaded auditors to
sign the piece of paper, are two very different things.

Yes, the PCI standard gives a list of 4 options and then continues on to
say that other creative solutions are acceptable as well.  But if you
discover mid-engagement that your auditor *thinks* it says "Thou shalt NAT",
you have a problem.

Anybody got recommendations on how to make sure the company you engage
for the audit ends up sending you critters that actually have a clue? (Not
necessarily PCI, but in general)

Attachment: _bin
Description: