5 ms·
I would guess that the majority of it was spent on dev work making the company processes fit the insane requirements of their PCI auditor.
by pja 10y ago
I would guess that the majority of it was spent on dev work making the company processes fit the insane requirements of their PCI auditor.
- jacquesm 10y agoIt says it was spent on the auditor, that's why I asked.
- akshatpradhan 10y agoPCI doesn't say anything crazy. Its all reasonable stuff. Scroll to page 20: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2.pdf https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2.... Networks, System Hardening, Boundary Protection, Access Control. Nothing in the PDF says anything unreasonable. The naysayers just don't want to open up the PDF and READ.
- jacquesm 10y agoYep. That's why 8M seems totally over the top unless you had a very large setup that was a total mess beforehand and even then it seems outrageous.