PCI 2.0 from PCI 1.2 Compliances Challenges to Organizations

Organizations must track and monitor all access to cardholder data and related network resources – in stores, regional offices, headquarters, and other remote access.

Yes, it is well documented that the three (3) tenets for adhering to PCI DSS 2.0 are as follows:

Assess - Identifying cardholder data, taking an inventory of your IT assets and business processes for payment card processing, and analyzing them for vulnerabilities that could expose cardholder data. Remediate - Fixing vulnerabilities and not storing cardholder data unless you need it. Report - Compiling and submitting required remediation validation records (if applicable), and submitting compliance reports to the acquiring bank and card.

Continue reading >>>

We see that a major barrier to PCI 2.0 success will be the Report tenet (requirement 10) for the Merchants & Service Providers (PCI DSS).

We advocate for organizations that require being PCI 2.0 compliant to establish a continuous monitoring platform (NISTIR 7756 - CAESARS Frameworks) that will enable the enterprise to have immediate situational awareness and analysis that:

• • provide transparency to events and activities associated with mitigating issues identified in the PCI 1.2 and PCI 2.0 assessment (initial state, transition state and steady state);
    
    
  • provide end-to-end visibility to when, where and how the non-compliant PCI issues was resolved (% completed, %outstanding);
    
    
  • provide on-demand dashboards and reports for quarterly, monthly, daily, hourly activities;
    
    
  • provide visibility to when a product / service has removed application specific PCI source code and / or purged PCI information from databases
    
    
  • demonstrates to current and prospective customers and business partners the organizations commitment to information security and privacy,