PCI work gets cheaper the smaller you can honestly make it. That is where ITS starts, and it is the step most providers skip because it sells fewer tools.
PCI DSS comes from the card brands and covers cardholder data. The FTC Safeguards Rule comes from federal regulators and covers customer information at non-bank financial institutions. Taking cards does not exempt you from the other one. If you finance, lease or arrange credit for your customers, see FTC Safeguards compliance.
PCI DSS organizes twelve requirements into six control objectives. Knowing which group your gap sits in tells you who has to fix it and roughly how much work it is.
Control objectives as published by the PCI Security Standards Council.
Network security controls between your cardholder data environment and everything else, and secure configurations instead of vendor defaults. Segmentation lives here, and it decides how big the rest of your program has to be.
Requirements 1 and 2.
Keep as little card data as you can justify, render it unreadable where you do keep it, and encrypt it in transit across public networks. The cheapest data to protect is the data you never stored.
Requirements 3 and 4.
Protection against malicious software, and a real process for finding, ranking and patching vulnerabilities in the systems in scope. Legacy systems that cannot be patched need a documented plan, not silence.
Requirements 5 and 6.
Access by business need only, unique identities with multifactor authentication rather than shared logins, and physical control over media and devices. Access that changes the day a role does.
Requirements 7, 8 and 9.
Logging and monitoring of access to systems and card data, with records kept long enough to answer who did what and when, plus the scanning the standard requires. This is the group most often failed, because it cannot be faked.
Requirements 10 and 11.
A documented information security policy and program, with risk assessment, staff awareness, service provider management and an incident response plan. This turns the other eleven into something that survives the year.
Requirement 12.
Two ITS clients on what changed once somebody owned their security program. Neither is quoted about card payments, and this section does not imply a PCI outcome.
ITS led significant, transformational changes at Eastern Plumas Health Care to ensure we weren’t susceptible to attacks. Looking back, prior to that partnership, we had a lot of risks on campus. I’m glad nothing happened, but I’m even more proud that after implementing those systems, we’ve avoided data breaches and HIPAA violations throughout our five-year partnership.
We always get a technician or an engineer that can solve the problem remotely and we have very little downtime. We’ve had a couple of times where we have had an employee that is prevented from working, and when we call in and we escalate quickly, we always have someone readily available to solve the problem.
A thirty minute consultation, a clear view of where card data flows, and the self assessment route that applies to you. No obligation.
