[Autogenerated] okay.
I can organizations make this cheap and efficient.
I mean, do they have to test of the point of sale devices?
So that's, like, physically tethered.
Well,
so so I think the thing that you really have to do before you start getting into
the tactical here's what we do on the ground is figure out,
you know,
from some essentially risk assessment or some threat
modeling what you're dealing with, right?
Um, you know, there are some cases where yeah,
maybe tethering or physically of fixing the device,
uh, makes a lot of sense, right?
And maybe some cases where it doesn't, uh and you know,
the requirements don't say do the inspection on this set schedule,
right?
You figure out what the appropriate frequency is now that
opens the door to sort of game the system and say we do it
once every 10 years right on.
And I'm sure there's sync USA that there will be like, Yeah, that's fine.
Right?
But that's not that's not the point.
The point is,
have some justifiable sort of rationale for your period of inspection,
right on the point of the standard saying,
I think it's periodic or whatever it does,
and I know we got criticized a lot for not saying how often that should be.
But we wanted it to be done right?
So what I mean by that was, if we just said daily,
right, in some environments, that would be applicable.
Someone could do that daily.
But other organizations couldn't do it daily,
so that's what it's what's what's best for your organization.
If you've got a roving store manager who's looking after 10
stores and they visit one store every day,
then they could be their responsibility to every time they visit the store.
That would fit into the logical argument.
Periodic for that organization was other organizations, you know.
They know one organization, uh, in a big multilane supermarket.
You know, they do it at the start of every day.
It's part of when you log on to the tail,
grab hold of the thing,
you scan the barcode on the bottom of it on the till
goes yet that's exactly the right one.
That should.
That's the one that should be there.
You don't have a lot of clients come up Well,
could we do it quarterly like Well, it is quarterly is a quarterly,
uh, you know, hostile activity.
Where that devices compromising, feeding data.
The bad guys.
Is that okay?
Are you okay with that?
It's like if you're in a restaurant where those
things are moving around all the time.
Maybe not.
If you're in a jeweler's, where it's where you're in a high security environment,
maybe.
Okay, right.
Exactly.
Right.
So So there needs to be some essentially good faith kind of
understanding of your particular sort of threat model and
saying this is our approach, right?
This is our schedule.
This is our our set of steps, right?
In some cases, yeah.
Maybe you need to weigh the devices and say,
this thing is 3 g heavier rut, row on.
In some cases, maybe that's extraneous or excessive, right?
But but you're gonna have to sort of work with your assessor
to figure that out and to have some justification for why
you're doing what you're doing.
So you're looking for risk is a necessity.
You're looking for the risk justification of how are they doing this, e m?
Because otherwise I'm gonna sort of poke at it and say why?
Why this frequency and not that right why this procedure and
not that when you go back for year two,
because this requirement being out for three years now.
So when you get when you go back for year two,
are you looking for records of evidence that this has done?
I am looking for records of evidence.
Show me that this is being done.
You know, maybe we'll grab some samples of devices,
or maybe we'll grab some samples of periods of time or something like that.
But show us, you know,
did you bite off more than you could chew in terms of what your procedures are?
And then everybody sort of ran out of gas and stop doing it.
Is this a common cause of phobia?
Now, um,
it's I think it can happen right where you get sort of
increasing the sort of perfunctory inspections that that
don't actually really look for things.
Um, and and certainly it's a point of risk, right?
This is what this is where bad guys do bad things.
Uh, so it is.
It is.
I'd say it's not maybe the most severe point of failure
that a lot of organizations face,
but it is okay on do you actually go into stores and ask the
people who are responsible for doing the inspection to show
you how they do in the inspection?
In some cases?
Yes.
Okay, right, Right.
So that's Z quite.
It's quite a lot of work in 9.9.
It is.
Yeah, it is.
It's a big task.
Um,
it's working because I know from my friends in the industry that the
number of overlays and skimming has decreased.
IT certainly number the number of replacements.
So there was a real problem with swap outs.
Exactly.
That's massively decreased because because of 9.9 going in place,
that's good to know.
A lot of that was down to people.
Just tethered, actually.
Actually put some physical security around the devices.
IT, especially if they get more expensive, more expensive.
They become the more assets.
So that's probably about physical wrapped up, isn't it?
I think so.
Yeah.
Well, great.
Thank you for that, Jacob.
Thank you.