PCI and Assessment Consistency

PCI SSC has released the ROC Reporting Instructions—the previously secret audit scorecard used by QSAs—to the public, so organizations can assess controls against the criteria auditors apply.

At the PCI Community Meeting last month in Las Vegas, one thing was abundantly clear – merchants and service providers need help.

Preparing for an audit can be one of the best ways to fund and improve your security program, but this “stimulus package” for your compliance effort typically dwindles once an organization completes or passes an audit.

A customer passed a PCI audit despite an accepted high-risk vulnerability, violating Requirement 6.5.6 (High findings must be fixed). QSA inconsistency carries fine and reputation risks.

From June 30, 2012, MasterCard Level 2 merchants self-assessing must use ISA-trained staff or hire a QSA. The article outlines the benefits of keeping an Internal Security Assessor on staff.

Passing an annual ROC or SAQ is not enough—PCI DSS is meant as a foundation for year-round compliance. The author offers a cheat sheet to schedule and assign recurring DSS 2.0 maintenance tasks.