Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

How to get PCI DSS compliance right

Six steps on the road to greater customer data security

The road to becoming Payment Card Industry Data Security Standard (PCI DSS) compliant can be a long one, so here we give you the Security Standards Council's Prioritised Approach of six milestones to help your organisation start your journey.

1. Remove sensitive authentication data and limit data retention

This milestone targets a key area of risk for entities that have been compromised. Remember – if sensitive authentication data and other cardholder data are not stored, the effects of a compromise will be greatly reduced. If you don’t need it, don’t store it.

2. Protect the perimeter, internal, and wireless networks

This milestone targets controls for points of access to most compromises – the network or a wireless access point.

3. Secure payment card applications

This milestone targets controls for applications, application processes, and application servers. Weaknesses in these areas offer easy prey for compromising systems and obtaining access to cardholder data.

4. Monitor and control access to your systems

Controls for this milestone allow you to detect the who, what, when, and how concerning who is accessing your network and cardholder data environment.

5. Protect stored cardholder data

For those organisations that have analysed their business processes and determined that they must store Primary Account Numbers, Milestone Five targets key protections mechanisms for that stored data.

6. Finalise remaining compliance efforts, and ensure all controls are in place.

The intent of Milestone Six is to complete PCI DSS requirements and finalise all remaining related policies, procedures, and processes needed to protect the cardholder data environment.

For more information see the Security Standards Council's paper.

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: Milestone
References show all

Comments

1

Armorguy

Sat 23/05/2009 - 10:59

Seriously??!!

This is intended to be a meaningful explication of PCI compliance? In less than 300 words?

Please, please, please - don't take what is a crucially important compliance issue and dumb it down like this again. You make yourselves look less than fully aware of the issues...

Your readers deserve better than this - and I suspect you know it. CIO has always stood for quality writing and editing - this doesn't due your reputation justice.

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the CIO comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: PCI secuity standard
Latest Blog Posts
Whitepapers
  • Oracle Business Process Analysis Suite
    Careful analysis and continuous optimization of business processes delivers real competitive advantage. Conversely, a random approach to process design negatively impacts a company’s bottom line. This insight is one reason successful companies adopt business process management (BPM) as a way of aligning their business processes with business and customer requirements. Success with BPM eliminates the gap between business strategy and implementation. Business users are empowered to participate in all stages of the business process lifecycle. Closed-loop integration between modeling, execution, and monitoring enables continuous and holistic business process improvement.
    Learn more »
  • Magic Quadrant for Enterprise Disk-Based Backup/Recovery
    While backup is among the oldest, most performed tasks in the data center, the industry is undergoing significant change as organisations accelerate new technology adoption and show a propensity to implement new solutions, in some cases from vendors that are emerging or new to the backup market.
    Learn more »
  • Award-winning unified information security from Clearswift.
    Fully integrated web and email gateway security solution, providing - protection from inbound threats, policy based encryption, and data loss prevention.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Recent comments