You’ve just finished a project successfully, on time, (mostly) on budget, and maybe even exactly what was asked for. You turn up to work the next day and there’s a new project waiting for you. Something called “PCI”. Suddenly, you’ve been dropped into a world of compliance, standards, security, reporting, and things you’ve never had to deal with before. And now you’re in charge of managing PCI compliance for your organisation. “It can’t be that hard,” you tell yourself. And then someone drops a 200-page set of standards on to your desk and tells you that your first meeting with the assessor is in 6 weeks.
In this article, we approach PCI from a project managers point of view. While we know some project managers have a security or technology background, we understand that not all do. And sometimes you are thrown into PCI purely because you’ve done well at managing large projects in the past.
In this article, we’ve detailed some of our key recommendations on how to approach PCI as a PM with the aim of both reaching compliance, but more importantly being able to manage cyber risk to your organisations payment channels as a part of ongoing BAU.
Know the standard. Know its value
The Payment Card Industry Data Security Standard (PCI DSS) is a set of twelve high-level
requirements which all merchants and service providers who take card payments or who
manage systems that are involved in card payment transactions are contractually required to
follow. PCI DSS impacts organisations across a wide range of industries. We’ve explored the
requirements in more detail here, which take a look at all 12 in detail, as well as help you
understand the level of evidence and reporting required based on your annual transaction
volumes.
Requirements aside, it is just as important to note that the value of PCI DSS doesn’t lie in a tick
of approval against each item, but rather in the enhanced and mature risk posture your
organisation will be able to adopt, particularly as it relates to your card and payment channels.
Areas of critical importance to the customers and citizens you serve.
Know the Teams and Players
As a merchant (or a service provider), you will be responsible for maintaining PCI compliance,
which is annually assessed and reported to your acquiring bank. The below diagram illustrates
some of the key parts of the PCI ecosystem and show’s how many different players there are in
helping you achieve and maintain PCI DSS compliance. It’s important is to understand what
external and internal teams you will need to engage as part of the PCI process, and support
from Senior Leadership can be the factor that makes or breaks an effective PCI compliance
programme.
Understand the scope, risks and timelines
One of the biggest challenges for organisations is to accurately understand their scope for PCI
DSS. Even if you do not directly store, process, or transmit cardholder data, but you accept
credit or debit cards as payment or you impact the security of someone else’s cardholder data
environment (CDE) you still have certain obligations under PCI DSS. The key thing is to be able
to show the transaction flow and have accurate network diagrams so that the assessor can
accurately validate what they think your scope is.
Cyber-Risk Oversight also plays a big part in any PCI project. It’s important to understand how
each of the organisations and teams you are working with view PCI risk and how. Acquirers
want to ensure that you do not have a cardholder data breach. Having a breach puts your ability
to take payments at risk.
Sometimes it’s easy to forget the end consumer when thinking about risk. They are the ones
who at the end of the day risk their personal card information being stolen by a malicious third
party – something not only inconvenient, but stressful and time consuming to address.
It’s also important to understand what timelines everyone is working towards. Our biggest
recommendation on this is to engage your bank, service providers, and internal teams early in
the PCI process. All of these parties want you to achieve compliance and will be more than
willing to discuss a reasonable timeline to achieve this.
Validate your assumptions
One of the biggest challenges we see organisations face as PCI assessors is when they
successfully complete their project and achieve PCI compliance, they then fail to go-on and
proactively manage their risk over the course of an assessment year. While a PCI assessment
takes place at a ‘point in time’, PCI itself is a minimum level of security that is required on an
ongoing basis – that’s why the standard includes requirements for annual, quarterly, monthly
and even daily checks, where changes are assessed and security improvements can be made
in a timely manner. This is why during an assessment you need to be able to show evidence of
what’s happened in the past to ensure that you can continue to meet that minimum level of
security assurance.
We’ve been doing quite a bit of thinking about this challenge at Confide which has resulted in
the development of our “Managed Assurance Programme” which is now being used with
success by many of our customers. This programme offers not only an in-depth PCI
assessment, but also ongoing consultation, check-ins and scanning activity over the course of
an assessment year.
Whatever stage of the PCI and security journey you and your organisation find yourself in, as
NZ’s leading QSA Assessment company Confide stands ready to help. Get in touch today!
Handover to responsible
Business-As-Usual (BAU)
teams. Keep PCI alive.
One of the biggest challenges we see organisations face as PCI assessors is when they
successfully complete their project and achieve PCI compliance, they then fail to go-on and
proactively manage their risk over the course of an assessment year. While a PCI assessment
takes place at a ‘point in time’, PCI itself is a minimum level of security that is required on an
ongoing basis – that’s why the standard includes requirements for annual, quarterly, monthly
and even daily checks, where changes are assessed and security improvements can be made
in a timely manner. This is why during an assessment you need to be able to show evidence of
what’s happened in the past to ensure that you can continue to meet that minimum level of
security assurance.
We’ve been doing quite a bit of thinking about this challenge at Confide which has resulted in
the development of our “Managed Assurance Programme” which is now being used with
success by many of our customers. This programme offers not only an in-depth PCI
assessment, but also ongoing consultation, check-ins and scanning activity over the course of
an assessment year.
Whatever stage of the PCI and security journey you and your organisation find yourself in, as
NZ’s leading QSA Assessment company Confide stands ready to help. Get in touch today!
