Through the Zoom Dimly: A Year of Remote Audits
summary
Standards bodies (PCI SCC, ISO, A2LA) allow remote assessments with documented exceptions, but PCI PIN/P2PE requires on‑site key operations so a few hours onsite for secure key injection remains necessary and is handled by lower‑risk staff. Physical security mostly works via live mobile video or pre‑recorded tours though some colos refuse and then controls are not tested. Remote audits expose evidence issues: authenticity, currency, completeness — plan tightly, pilot data collection, and track evidence age.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 1:32Governing bodies made accommodations
- 3:19Things changed
- 5:09Remote work issues
- 10:15Physical security controls
- 12:53Longtail PCI standards
- 14:49Lack of inperson interactions
- 17:09Evidence gathering
- 18:14Authenticity
- 21:12Currency
- 24:12completeness
- 25:37planning
- 27:33evidence age
- 29:30the new normal
- 29:52more teams are distributed
- 31:24clients dont want onsite work
- 32:18new version of PCI DSS
- 33:38preparation begins
- 34:37show up prepared
- 35:30plan for the unknown
- 36:38start planning
- 38:30conclusion
related talks
06mLightning Talk: PCI DSS and
01h 02mDiscussion - Auditors, Sessions 3 & 4
28mKeeping the Bank Happy: PCI DSS v4
25mDemystifying remote attestation
37mKeylime: Pushing the Boundaries of Remote Attestation on the Edge
33mPKI PKI and PQC Strategy for Payment Card Industry
33mAutomated Security Scanning in Payment Card Industry
24mFrom Trust Assumptions To Trust Evidence: Why PKI and Confidential Computing