4 Ways to Get the Most From Your PCI QSAs

CSO — In an interview with CSOonline last month, Heartland Payment Systems Inc. CEO Robert Carr lashed out against qualified security assessors (QSAs) who audited his company for PCI security compliance, claiming they missed key network holes that ultimately enabled a massive data security breach. Readers hit back, slamming Carr for not owning up to problems rampant in his IT security operation -- for one example, read One Man's View: Heartland CEO Must Accept Responsibility.

Also see Heartland CEO on Data Breach: QSAs Let Us Down

Slideshow: When Rogue IT Staffers Attack: 8 Organizations That Got Burned

In response to the response, CSOonline polled security experts who have performed and received assessments in an effort to create a brief checklist for getting the company-QSA relationship off to the best possible start. Here are four key suggestions:

1. Choose your vendor wisely

One common problem is that the QSA is chosen too hastily because the company wants to get the process over with as quickly as possible. The result is that the company hires an assessor that isn't as well versed in the issues unique to their environment.

Mark Allison, vice president of information security at Las Vegas-based Global Cash Access, said companies must conduct a thorough vetting of all QSA providers to ensure whoever is chosen specializes in the problems most common in their particular industry.

"Ensure the vendor has SME's that meet your needs and don't be alarmed if some vendors subcontract with other qualified entities to build a comprehensive response," he said. "Like you, professionals leverage their strengths and shore up limitations by hiring expertise. Do your homework and assess the credentials of all vendors and participants and understand how blending their efforts into a comprehensive plan can lead to successful execution."

2. Lay the groundwork

One thing that's certain to get a company's security assessment off to a bad start is a lack of planning, Allison said. Therefore, he recommends starting with a self assessment. That way, the company has a pretty good idea of where the weak points are before the QSA arrives. On day 1, security administrators should brief the QSA on everything they know up to that point. That way, the QSA can sharpen his/her focus on particular problem areas and come up with a more productive action list.

"Obtain the latest self-assessment questionnaire from the PCI DSS website," Allison said. "And remember that anything less than complete candor will impede your assessor's ability to complete their work efficiently and effectively."

Continue Reading