Documentation
Posted: Thu 4 February, 2010 | Author: Lyle | Filed under: D4D™, Domestic, Security, Web Development, Work-related, Writing |3 Comments »In the run-up to the Festering Season, I had one hell of a lot of work coming in with some documentation that needed doing in order to get us what’s known as PCI-DSS accreditation. PCI-DSS stands for “Payment Card Industry Data Security Standard”, and it’s a total fucking nightmare.
Anyway, one of the big steps in attaining this PCI-DSS standard is to have somewhere around a metric shit-ton of paperwork. No kidding. There’s some 230-odd points in the PCI-DSS standard, and each one of the bloody things needs documenting. It’s a serious bit of work just getting all the paperwork done.
With the other stuff I also had to do in order to get everything in place, the documentation took a back-seat, and we ended up getting it done by me speaking into a dictaphone, and then getting an audio-typist to type it all up. It was supposed to save me a stuff-load of time. And it worked – I’d got all the dictation done in two and a half days, and the typist did everything in time for mid-January.
Or so we thought.
It turned out that the audio-typist was a tossbag, and didn’t actually do all that much in the day they were in – at the end of which they said they’d done it all.
Cunty fucking bugger.
It’s taken me the intervening three fucking weeks to get things back to where I thought I was in mid-January. Three weeks of doing this sodding documentation, three weeks of making sure it’s right, and that it all makes sense. Oh, and still doing all my normal insane workload as well.
This goes some way to explaining why I haven’t been writing much on D4D in that time – I’m utterly damn sick of typing, and didn’t have the time or headspace to do much here.
I’ve just now finished the documentation for PCI-DSS. We’ll review it tomorrow and next week, so I’m sure there’ll be some edits. But that’s just fiddly crap – the most important thing is that I’ve broken the back of it. I’m done.
I’m also utterly fucked. But that’s beside the point. I’m done with the documentation. Happy, happy day.
Everyone ALWAYS underestimates how long it takes to write up , and then properly edit, documents, so I’d take your “fiddly crap” and add a few more days.
If it takes that much work to get compliance, is that why many (even large) companies use Sagepay and similar for their internet sales?
If you ever need a highly competent audio-typist again, drop me an email. I have two ‘virtual assistants’ in my local network and both are fantastic, reliable, good value, and can cope with anything. Or else get Dragon and run the digital files through that. Yes, there will be errors the first time, but it learns very quickly.
Yep, it is – it’s a lot easier to leave it as “Someone else’s problem” than to go through the PCI-DSS compliance yourself.
If you just pass the number through to a payment provider, you only have to do a hyper-basic self-cert compliance that pretty much says “Yes, our people are ID-checked, and we don’t store credit-card numbers anywhere on the premises/in the business”. Makes much more sense.