Menu Close

PCI Compliance can be a good Start to a Security Policy

tonyz

As I wrote in my blogsite www.oversitesentry.com PCI compliance is a good way to get started if you have not yet done so on the path of creating good Cybersecurity in your organization.

IF you are accepting credit cards, then you _should_ be PCI compliance standard capable. So it is a lot to take on if you have nothing, but it can be easier if you do not develop computer code so that you accept credit cards.

My slightly simplified headings:

First inventory all your systems (software and hardware).

  1. Firewall maintenance (set up proper procedures to edit the ACL – Access Control List)
  2. Change your default passwords (and create a password policy)
  3. Protect stored cardholder data (if you are not developing software or have a website that you are developing – this may not be necessary)
  4. Encrypt Cardholder data – i.e. use devices that encrypt cardholder data (or develop this properly)
  5. Protect all systems against malware (using anti-virus software)
  6. Develop and maintain secure applications (only if you are developing software)
  7. Restrict access to cardholder data (if developing authenticate before giving access)
  8. Identify and authenticate access to system components
  9. Authentication physical access (only qualified people should access credit card systems)
  10. Track and monitor all access to network resources and cardholder data (log systems)
  11. regularly test security systems and procedures
  12. Maintain a policy that addresses security information for all personnel
12 parts of PCI compliance

So from this point one can remove step 6 if there is no computer code helping you accept credit cards.

Step 4 should be handled by the credit card processor devices

Step 3,7,8, and 9 is easier with no coding.

Now all you have to focus on is 1,2,3,5,10,11, and 12 which you should be doing already, maybe you have no documentation, but it is being done (or should be).

If you ask me, 1,2,5,10,11,12 should be done no matter whether you have credit card processing or not. Someone should be accumulating bits and pieces until you have a proper security policy.

THAT is what we do!! We can help you with creating a security policy from scratch. Contact Us