PCI Project Manager

Appointing an internal project manager (PM) assists in PCI efforts. The benefit is that one internal point of contact can own the project and be responsible for ensuring its success. The appointed individual can only be as successful as the support they have been afforded. Without senior management support, the process of acquiring additional money and resources to address assessment findings will take significantly longer and cost more than necessary. Additionally, PCI-imposed changes to IT infrastructure and business process requires the full support of mid-level managers and the in-house expertise of senior and junior technical personnel.

A dedicated PCI PM can take responsibility for identifying and communicating PCI compliance requirements, mapping existing organizational skill sets to required mitigation tasks and tracking tasks as they move toward completion. The PM also schedules regular meetings to assess project progress and provide regular updates to project plans and reports.

Outsourcing PCI Remediation

Achieving PCI compliance may require organizations to restructure not only their IT environment but also significantly retool their business processes. Trying to factor PCI compliance into existing plans and programs may tax existing personnel and budgets; it's not uncommon for staffing to be optimized to a point where it's not feasible to accommodate increased workloads. In such cases, it may be worthwhile to consider outsourcing PCI project management and other functions around PCI remediation.

Reducing PCI Scope

Reducing the scope of a PCI assessment is often advocated when the recommended changes to the environment have become cost prohibitive or will adversely impact the business or organizational mission.

Some merchants have constructed their POS applications and associated infrastructure with an aggressive eye toward reducing costs at every turn. Often, this infrastructure has evolved to be comingled with non-PCI systems that may have been designed with little or no thought to protecting sensitive information. If there is little or no separation between these systems then PCI requirements will apply to all of the systems within this environment.

Re-architecting such an environment to support PCI-related system hardening requirements—such as monitoring, logging and auditing—may be cost prohibitive. In such instances, it's reasonable to consider moving the PCI systems into their own dedicated environment and limiting their interaction with non-PCI technology. This helps reduce the number of critical systems to be reshaped into compliance and will enhance security by placing them in a controlled and monitored environment.

The DSS reinforces the concept of segmentation between PCI and non-PCI systems. While it doesn't specifically mention virtual local areas networks (VLAN) per se, it's often useful to implement network architecture such that it provides separate, dedicated virtual networks for PCI components. This can be accomplished via a combination of VLANs and network routing that helps to contain and secure PCI systems, and also minimizes their interactions with non-PCI systems.