PCI 2.0 scoring matrix released to the public (now your kids can play “PCI Auditor” at home!)

As many organizations that have hired QSAs recently have seen, the Report on Compliance (ROC) has changed quite dramatically for v1.2 of the PCI DSS standard from previous versions.

From June 30, 2012, MasterCard Level 2 merchants self-assessing must use ISA-trained staff or hire a QSA. The article outlines the benefits of keeping an Internal Security Assessor on staff.

Passing an annual ROC or SAQ is not enough—PCI DSS is meant as a foundation for year-round compliance. The author offers a cheat sheet to schedule and assign recurring DSS 2.0 maintenance tasks.

In late March Thales released an interesting report on the state of PCI – “PCI DSS Trends 2010: QSA Insights Report.”

At the PCI Community Meeting last month in Las Vegas, one thing was abundantly clear – merchants and service providers need help.

I attended the PCI-SSC community meeting this past week (September 22-24). There were three key issues discussed that showed that the PCI program is maturing and that a number of standards and regulations are converging (both in and outside the PCI world).