requirement 12

Policies and Procedures | SAS 70 | PCI DSS | An Auditor’s Viewpoint

Policies and Procedures-it’s such a common theme and phrase in today’s regulatory compliance and governance arena, so much so, i think it should have it’s own Wikipedia page. It can be an arduous undertaking in developing these documents. Furthermore, policies and procedures are becoming increasingly larger and larger in scope for compliance initiatives.

Take a look at Requirement 12 for PCI DSS compliance; Maintain an Information Security Policy. It’s quite detailed, to say the least. Furthermore, there are numerous other P&P requirements sprinkled throughout the other 11 PCI DSS requirements.

As for SAS 70, the audit’s success also depends on policies and procedures for a large range of items. A few examples of common P&P documents that may fall under the scope of a SAS 70 Type I or SAS 70 Type II audit are as follows:

Change Management P&P
An organizational wide security policy handbook with documented P&P
Backup P&P
SDLC documentation

To be blunt, most organization despise authoring these documents for a number of reasons: time, cost, or the simple inability to write effective P&P documents.

Even with that said, organizations need to be aware of the growing requirements for P&P for SAS 70, PCI DSS, and a whole host of other regulatory compliance mandates.

PCI DSS Level 1 Compliance | Helpful Tips from a PCI QSA

Payment Card Industry Data Security Standards (PCI DSS) Level 1 compliance can be a very arduous, time-consuming and costly undertaking for any organization. However, there are a number of proactive steps that should be put in place for helping ensure an efficient and transparent assessment process is in place.

I stress the word “transparency” because the more information you provide a PCI QSA, the better understanding her/she will have when engaging to conduct the PCI DSS Level 1 assessment on your organization.

Here are some helpful tips:

1. Develop in-depth network topology documents that clearly illustrate the cardholder environment. Do not omit any “system components” from these drawings as PCI QSA’s need a true understanding of network topology.

2. Take a hard look at Requirement 12 of the PCI DSS standards-Policies and procedures play a big and important role in ensuring compliance for PCI DSS. If you do not have these PP in place, you need to start writing them internally, or expect to pay a king’s ransom for external auditors or consultants to write these documents for you.

3. Make a list of all external, third party vendors and outsourcing entities that your organization uses. This is important because data centers and other types of managed services entities often fall into the scope of a PCI DSS assessment.

If you want to learn more about PCI DSS compliance, visit pciassessment.org

What is Required for PCI Assessment? | PCI DSS Q and A

What is required for PCI assessment compliance? This is a question i’m often asked, especially by organizations that need to comply with Level 1 of the PCI DSS standards, which is an on-site assessment conducted by a Qualified Security Assessor (QSA), such as myself. Well, here is what you need to “comply” with according to the PCI standards:

Build and Maintain a Secure Network

* Requirement 1: Install and maintain a firewall configuration to protect cardholder data
* Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data

* Requirement 3: Protect stroed cardholder data
* Requirement 4: Encrypt transmission of cardholder data across open, public networks

Maintain a Vulnerability Management Program

* Requirement 5: Use and regularly update anti-virus software
* Requirement 6: Develop and maintain secure systems and applications

Implement Strong Access Control Measures

* Requirement 7: Restrict access to cardholder data by business need-to-know
* Requirement 8: Assign a unique ID to each person with computer access
* Requirement 9: Restrict physical access to cardholder data

Regularly Monitor and Test Networks

* Requirement 10: Track and monitor all access to network resources and cardholder data
* Requirement 11: Regularly test security systems and processes

Maintain an Information Security Policy

* Requirement 12: Maintain a policy that addresses information security

Sure, it is lengthy and an arduous task, to say the least. Remember though, there are four (4) different levels of compliance for PCI DSS, with most organizations falling into levels 2,3, and 4. Level 1 compliance can be very time consuming, but so can Levels 2,3, and 4 if you do not have a good grasp on what is required by the PCI DSS standards. My recommendation, consult with a PCI QSA on what level you fall into and what assistance you may need.