Befuddled companies get checklist for complying with PCI security standard
PCI council releases compliance framework for meeting payment card data-security rules
March 9, 2009 12:00 PM ETComputerworld - The organization responsible for administering the Payment Card Industry Data Security Standard (PCI DSS) is offering new guidance to companies on how to comply with the rules for protecting credit and debit card data.
PCI Security Standards Council LLC, which was set up by Visa, MasterCard, American Express and other credit card companies in 2006, last week released a document (download PDF) that lists the most efficient order for companies to implement the 12 security controls mandated under PCI DSS. The prioritized approach groups the controls under six milestones that companies can use as a road map towards compliance, according to council officials.
Bob Russo, the council's general manager, said the framework is "the culmination of a lot of input" from various stakeholders within the payment card industry. It's designed, he added, to help companies that haven't yet to start on their PCI compliance efforts and are wondering what they should do first.
The release of the rollout guidance by the council comes nearly four years after the PCI standard first went into effect, imposing a set of data security requirements on all entities that accept credit and debit card payments. The effort to create the framework indicates that many merchants, especially smaller ones, still aren't fully compliant with the standard and need help implementing it, said Jim Huguelet, an independent PCI consultant in Bolingbrook, Ill.
"I think there are a lot of merchants who feel overwhelmed at the amount of remediation they need to undertake to become fully compliant," Huguelet said. That, he added, has resulted in a sort of "paralysis" in which some merchants either are doing nothing in regards to PCI compliance or are only taking on some of the easier requirements, which by themselves do little to reduce the overall security risks faced by companies that process card transactions.
By offering a framework that explicitly ranks the relative importance of the different requirements, the PCI council has finally given businesses that have yet to comply with the rules a way to move forward, according to Huguelet. "The journey of a thousand miles begins with a single step, and the PCI [council] has now officially announced what those first steps for merchants really should be," he said.
The first of the six milestones outlined in the framework deals with the need for companies to purge sensitive card-authentication data from their systems and limit the amount of data that they collect and retain. Among the measures that have to be implemented in this stage are purging magnetic-stripe data and personal identification numbers (PIN) from systems and destroying old data storage devices via measures such as shredding.
PCI
Additional Resources



Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.
White Papers & Webcasts
Death to PST Files
Download Now
The Tangled Web: Silent Threats & Invisible Enemies
Download Now
Tape Killed the IT Guy
Watch Now
Forrester Consulting Mobility Study: Taking Control of Enterprise Mobile Device Diversity
Download Now
BRM: What You Can Do To Reduce Risk In Challenging Times
Watch this webcast now!
What IT Must Do to Support Employee-Owned BlackBerry, iPhone and Android Mobile Devices
Download Now
Web 2.0, Social Media and the Dark Web - A Web Criminals Paradise?
In this discussion, learn about the challenges of protecting your users from the potentially unsafe content hidden in the "Dark Web".
eGuide: Enterprise Security
Smart Security Strategies for 2010. Read now!
Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...

