Common Compliance Hurdles Part 3: Data Retention

In a previous post, I mentioned that the Security Standards Council would be releasing a new version of the Self Assessment Questionnaire (SAQ) for merchants using virtual terminal environments for processing cardholder data.

Some of the team from NetSPI spent the week in sunny Orlando at the 2010 PCI North American Community Meeting.

Since the role of the Chief Information Security Officer (CISO) and how he or she reports has a major impact on security and risk, I think it’s interesting to look at how different organizations have structured the position. With that said, there is very little consistency other than a correlation with the industry vertical’s understanding of IT risk.

At the PCI Community Meeting last month in Las Vegas, one thing was abundantly clear – merchants and service providers need help.

As the PCI Community Meeting is set to start tomorrow, I have been thinking about the current state of the retail marketplace and what that means for NetSPI's focus--security and compliance.

The last few years have seen a great deal of discussion, arguing, hand-wringing, and posturing within the retail/hospitality community regarding the PCI DSS.