Frosty Assessor

Working with a good QSA can be a useful way to validate one's PCI controls and assumptions. They aren't just a speed bump toward getting your ROC. As with all things, though, there are good assessors, and there are bad assessors.

---

Frosty Assessor

Frosty Assessor
Was a nosy, noisome soul.
With his DSS and his calipers
And a soul as dark as coal.

Audit the people
To ensure that they comply.
If they don't, he'll know
And your biz won't go.
You'll be left outside to cry.

There must have been some documents
That covered all the things.
'Cause when he looked at evidence,
He began to dance and sing.

Frosty Assessor
Gave a passing grade that day.
Now for PCI,
And we just won't lie,
We're compliant, yeah, oh, yay!

Bumpity-bump-bump!
Bumpity-bump-bump!
Watch the spreadsheets go.
Bumpity-bump-bump!
Bumpity-bump-bump!
Through every rule he'll mow!

I Have a ROC

I Have a ROC
(based on the Simon and Garfunkle tune)

A springtime day,
Every year so we'll remember.

I am alone.

Gazing at my Dashboard,
At responses so,
I can make sure the evidence will go.

I have a ROC!
I have compli-i-i-iance!

I have docs,
They make a stack tall and mighty!
That none may penetrate.
I have to do an audit.
An audit causes pain.
It's question after question! So insane!

I have a ROC!
I have compli-i-i-iance!

Don't talk too much.
Assessors heard it all before.
We're facing down a QSA,
And I let a quick comment
Make them ask me more.
Our processes should be enough and more.

I have a ROC!
I have compli-i-i-iance.

I have my NOC!
And my user training to protect me.
I am shielded by firewalls.
I have my AV,
Safety's watching me.
Nothing's gonna get me hacked, you'll see.

I have a ROC!
I have compli-i-iance.

And a ROC is endgame.
But at the end, I always cry.

A POAM Poem

A POAM Poem

FISMA is abysmal
It makes us jump through hoops.
We need a plan of action
And milestones to boot!

The OMB are meanies
And gatekeepers most dour.
The JAB keep watch unsmiling
With attitudes most sour.

We do our song and dance
For 3PAOs every year.
But they are not impress'ed
With what we're doing here.

And so we have a freak-out
A fire drill, a scramble.
We have to write a POAM
That we hope is not a gamble.