Care and Feeding of your PCI DSS Compliance Program

As many organizations that have hired QSAs recently have seen, the Report on Compliance (ROC) has changed quite dramatically for v1.2 of the PCI DSS standard from previous versions.

Preparing for an audit can be one of the best ways to fund and improve your security program, but this “stimulus package” for your compliance effort typically dwindles once an organization completes or passes an audit.

Building a cloud pentesting program starts with secure design, accounts for the shared responsibility model, and avoids assuming cloud services are secure by default, per NetSPI.

Starting June 30, 2012, PCI DSS requirement 6.2 makes risk ranking of new vulnerabilities mandatory rather than a best practice, affecting organizations filing SAQ D self-assessments.

PCI SSC has released the ROC Reporting Instructions—the previously secret audit scorecard used by QSAs—to the public, so organizations can assess controls against the criteria auditors apply.

Because of increasing threats, high-profile data breaches, and increased awareness of the damage they cause, we anticipate a substantial tightening of regulations and contractual requirements that will significantly impact information security in healthcare.