1,179 reputation
142
bio website
location
age
visits member for 3 years, 5 months
seen Jul 29 '11 at 9:51

Jul
23
awarded  Yearling
Jul
23
awarded  Yearling
Jul
23
awarded  Yearling
Mar
20
awarded  Great Answer
Jul
24
awarded  Good Answer
Jul
23
comment Our security auditor is an idiot. How do I give him the information he wants?
To be fair, though, (as I can't edit the answer above) I'd just like to add that your answer is correct. If the server holds personal data, anything that weakens that server or the system accessing it is technically in scope of principle 7.
Jul
23
comment Our security auditor is an idiot. How do I give him the information he wants?
Assuming there's any personal information on those servers, yes. But it's far from clear there is. Are you suggesting it would be ok if he passed over the plain text passwords of all servers not holding personal data? The main issues are that this is a) against policy, and b) against PCI. You don't need to bring distractions into it.
Jul
23
comment Our security auditor is an idiot. How do I give him the information he wants?
This has nothing to do with the data protection act, which is purely related to personally identifiable information. From the sound of it, this is a PCI audit.
Jul
23
awarded  Nice Answer
Jul
23
awarded  Teacher
Jul
23
answered Our security auditor is an idiot. How do I give him the information he wants?