Pre-Assessments

Performing a pre-assessment prior to the anticipated visit of the PCI Qualified Security Assessor (QSA) is a valuable exercise. It's also important to have a follow-up meeting after a pre-assessment as this allows the project team to review and discuss the findings and get a head start on remediating items that the QSA might eventually find.

Obtain Compliant ROC and Submit to Appropriate Entities

Following the final PCI assessment and once the all of the relevant PCI assessment items have been fully mitigated, the QSA will then produce the final Report on Compliance (ROC). This report shows that all of the required compliance criteria are "in place" within the given environment. If there are any items not marked "Not In Place," the report cannot be submitted. The processor, acquiring bank or card brand will reject it.

When to Begin Planning for Next Year's ROC

Following the initial certification, it's important to begin planning for the next year's impending PCI assessment. Achieving initial compliance often requires significant organizational and business process changes, and additional capital investment. It may also require some measurable preplanning to maintain compliance in the face of impending new PCI requirements.

Production applications can rarely be retooled in short order. Merchants with Web-facing e-commerce applications should seriously consider a lead time of six months to nine months to redevelop, fully test and deploy them within the production environment to maintain compliance.

PCI Real-World Lessons

The ultimate success around PCI depends on how committed management is to it. If management cares, your organization is likely to have had effective security in the first place, and it's likely you can achieve PCI compliance in the short term. If management doesn't care or is clueless, your organization's security is likely already in the hole and PCI failure is inevitable.

Organizations that have had the most success in their PCI efforts have done so by approaching PCI from a risk-driven model. Such an approach enables resources to be prioritized around business risks, which ensures that resources allocated are directly in line with those that contribute to the achievement of corporate objectives.

Such an approach is the cornerstone for an effective PCI compliance program management system. This is a formal system of risk management which can show that the PCI requirements and resulting work have been adequately planned and supervised. Notice that the operative word here is formal. A few IDS sensors rolled-out over the previous weekend don't display that, nor do security hardware and software systems deployed without proper policies, documentation, administrator training, etc.