{"id":94,"date":"2016-10-09T07:36:59","date_gmt":"2016-10-09T13:36:59","guid":{"rendered":"http:\/\/pcmdx.net\/blog\/?p=94"},"modified":"2016-10-09T07:43:47","modified_gmt":"2016-10-09T13:43:47","slug":"pci-compliance-an-ongoing-process","status":"publish","type":"post","link":"http:\/\/pcmdx.net\/blog\/2016\/10\/09\/pci-compliance-an-ongoing-process\/","title":{"rendered":"PCI Compliance – An Ongoing Process"},"content":{"rendered":"

Recently Computer World published what’s most likely the very best article dealing with PCI Compliance<\/a>. \u00a0Not so much what it entails to be<\/em> compliant, but what it takes to remain<\/em> compliant.<\/p>\n

http:\/\/www.computerworld.com\/article\/3126187\/retail-it\/the-ultimate-unanswerable-question-are-we-pci-compliant.html<\/p>\n

 <\/p>\n

The issue with PCI compliance is that the business network and the business environment is constantly changing and evolving. \u00a0There are 12 requirements in\u00a0the PCI DSS<\/a>. \u00a0In order to be compliant, all of these must be current all of the time. \u00a0Some remain static, meaning they don’t change.<\/p>\n

Let’s take requirement No. 1:\u00a0Install and maintain a firewall configuration to protect cardholder data<\/strong>. \"firewall-156010_640\"<\/a>\u00a0Your PCI specialist installs and configures a firewall. \u00a0Once it has been configured properly, you’ve met the first requirement, right? \u00a0Well, sort of. \u00a0Assuming the firmware is current, and nothing changes in the network environment, the answer would be Yes, you’ve met the requirement.<\/p>\n

Let’s go down to requirement No. 11: \u00a0Regularly test security systems and processes. \u00a0<\/strong>Inside this requirement is 11.1, which requires that a hardware inventory be kept up to date of all devices on the “protected” or POS network. \u00a0This is the network that handles all credit card transactions (your guest wi-fi, or any other network should NEVER<\/strong> be on the same sub-net as your POS traffic). \u00a0You just replaced or added a POS terminal. \u00a0Did you log it in the inventory, including the model and serial number? \u00a0If the answer is No, then you’re not compliant.<\/p>\n

On that very same replacement terminal, you need to make sure that you have met requirements 5 and 6:\u00a0Use and regularly update antivirus software;\u00a0Develop and maintain secure systems and applications. \u00a0<\/strong>If you’ve added a location on the network for this terminal, the network diagram also needs to be updated.<\/p>\n

Now let’s move on the the human factor in being compliant. \u00a0Each individual who handles credit cards must be trained in the methods of handling cards safely and securely, which is part of requirement 12: \u00a0Maintain a policy that addresses information security<\/strong>. \u00a0If you’ve hired a new employee, they must first be trained and sign-off acknowledging that they’ve been trained. \u00a0A copy of the signature page must go in their employee file.<\/p>\n

The article in Computer World makes some outstanding points. \u00a0First, \u00a0you’re only compliant on the date that you last checked and updated\u00a0(successfully) the requirements:<\/p>\n

The reason why compliance is tied to the date the assessment was wrapped is that, in theory, any change at all to anything on the network could make that merchant noncompliant. I get that. It makes sense. But what good is PCI compliance if a retailer never knows if it is compliant?\u00a0<\/strong><\/p>\n

This is where PCMDX comes in. \u00a0We take it off your shoulders and put it on ours. \u00a0We let you worry about the prime purpose of your business, and we take care of the things that we’re good at: \u00a0Keeping you compliant.<\/p>\n

Further more, as the article states, it’s the human factor that makes you (and keeps you) compliant:<\/p>\n

But it (software) can’t track PCI compliance \u2014 which is a human-dictated state \u2014 any more than it can declare a system “secure.”\u00a0<\/strong><\/p>\n

PCMDX<\/strong> is the only company in our service area (Alabama, Mississippi, Western Tennessee, Florida Panhandle) that creates a plan for your company to become, and remain, PCI Compliant. \u00a0We will visit your site, examine your existing network, create a plan to make your network compliant, implement the plan, and then keep it maintained on a regular schedule.<\/p>\n

Contact us today<\/a> for a free, no-obligation consultation. \u00a0You’ll be glad you did.<\/p>\n

 <\/p>\n

 <\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Recently Computer World published what’s most likely the very best article dealing with PCI Compliance. \u00a0Not so much what it entails to be compliant, but what it takes to remain compliant. http:\/\/www.computerworld.com\/article\/3126187\/retail-it\/the-ultimate-unanswerable-question-are-we-pci-compliant.html   The issue with PCI compliance is that the business network and the business environment is constantly changing and evolving. \u00a0There are 12 […]<\/p>\n","protected":false},"author":1,"featured_media":99,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,9,21,4,10],"tags":[44,13,23,24,31],"class_list":["post-94","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-computer-protection","category-network","category-pci-compliance","category-pcmdx","category-security","tag-firewall","tag-network-security","tag-pci-compliance","tag-pci-dss","tag-pcmdx"],"_links":{"self":[{"href":"http:\/\/pcmdx.net\/blog\/wp-json\/wp\/v2\/posts\/94","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/pcmdx.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/pcmdx.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/pcmdx.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/pcmdx.net\/blog\/wp-json\/wp\/v2\/comments?post=94"}],"version-history":[{"count":1,"href":"http:\/\/pcmdx.net\/blog\/wp-json\/wp\/v2\/posts\/94\/revisions"}],"predecessor-version":[{"id":100,"href":"http:\/\/pcmdx.net\/blog\/wp-json\/wp\/v2\/posts\/94\/revisions\/100"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/pcmdx.net\/blog\/wp-json\/wp\/v2\/media\/99"}],"wp:attachment":[{"href":"http:\/\/pcmdx.net\/blog\/wp-json\/wp\/v2\/media?parent=94"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/pcmdx.net\/blog\/wp-json\/wp\/v2\/categories?post=94"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/pcmdx.net\/blog\/wp-json\/wp\/v2\/tags?post=94"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}