Beyond the PCI Audit: Helping Merchants and Service Providers as a Partner

As many organizations that have hired QSAs recently have seen, the Report on Compliance (ROC) has changed quite dramatically for v1.2 of the PCI DSS standard from previous versions.

A customer passed a PCI audit despite an accepted high-risk vulnerability, violating Requirement 6.5.6 (High findings must be fixed). QSA inconsistency carries fine and reputation risks.

Maybe, maybe not. If you are a payment application vendor, are you worried about the changes that have happened with the new release of the Payment Application Data Security Standard (PA-DSS)?

One typical question NetSPI receives from IT managers is "What does PA-DSS entail?" Hopefully, this will give you some answers.

In this, the second installment in a series discussing common PCI compliance challenges, I address non-compliant payment applications.

I am currently on my way back from Las Vegas and the PCI (Payment Card Industry) Assessors Meeting.