What’s New in PCI DSS 2.0 – No Surprise That There Are No Surprises

PCI DSS 3.0's biggest adoption pain will likely come from clarifications rather than new requirements, especially the expanded scoping guidance covering systems connected to or impacting the CDE.

In continuing with my series addressing common compliance hurdles relating to Payment Card Industry (PCI) requirements, I would like to turn to the topic of data retention.

As an information security professional, my experience within the payment card security industry has taught me that credit card fraud is not just an information security or information technology issue, but increasingly also a financial one.

In late March Thales released an interesting report on the state of PCI – “PCI DSS Trends 2010: QSA Insights Report.”

Since the role of the Chief Information Security Officer (CISO) and how he or she reports has a major impact on security and risk, I think it’s interesting to look at how different organizations have structured the position. With that said, there is very little consistency other than a correlation with the industry vertical’s understanding of IT risk.

At the PCI Community Meeting last month in Las Vegas, one thing was abundantly clear – merchants and service providers need help.