PCI Regulatory Compliance Guidance and Planning

Challenge

Payment Card Industry (PCI) regulatory compliance is a complex topic. Compliance standards have many provisions, and addressing them all can be a painstaking, expensive process. The challenge is made even more complex by the different card brands' unique reporting requirements. Understanding PCI regulatory compliance is a discipline in itself, but few organizations possess the resources needed to develop internal expertise in this complex practice. Organizations dealing with these complex issues have many questions: To whom should the organization report compliance? How do standards for compliance differ between franchises and corporate locations? Are requirements different for service providers than for merchants?

PCI compliance can be especially challenging for smaller merchants, which may lack the dedicated information security or auditing staff needed to understand and respond to the self-assessment questionnaire. In addition, timelines for compliance may be tight, making a pre-assessment critical for ensuring that any holes in the organization's compliance structure can be caught early. If they are caught during the onsite assessment, it may not be possible to ensure full remediation before the compliance deadline, which often means substantial fines.

Solution

Preassessment workshops and PCI strategy sessions are key components of Secure Application's approach to PCI. Because customers' requirements are different, we create customized consulting regimens for different customers. We provide an onsite QSA to provide guidance and act in an advisory role to help you better understand your organization's exposure to PCI compliance. Our QSAs help identify PCI gaps, create a plan to address these gaps and lay out a roadmap for future compliance efforts.

Benefits

• Provides data flow analysis reports that show you where cardholder data resides, enabling you to better protect data assets
• Gives your organization QSA assistance to position it for success in its compliance efforts
• Lends confidence that your PCI compliance initiatives are being led by professionals certified by all major card brands, including Visa and MasterCard

Secure Application provides a PCI Executive Workshop and Analysis as a first step for the organization in ascertaining the scope of its PCI liability.
The recommended PCI Executive Workshop and Analysis program addresses the following key components:

• Scoping the cardholder environment, including identification of all business units handling cardholder data and the associated processes surrounding cardholder data usage
• Recommending the removal of cardholder data from identified areas
• Reducing PCI compliance scope by leveraging segmentation, encryption, tokenization or a combination of strategies (when removal of cardholder data is deemed infeasible)
• Documenting all areas of concern identified, developing a high-level diagram of the cardholder environment and recommending steps for remediation