PCI Compliance

Recent accounts of highly-publicized data breaches occurring in companies that are seemingly PCI compliant, begs the question, "does PCI compliance equal security?" The answer is, "not necessarily."

The PCI Security Standards Council's goal in forming the standards was to create a unified outline of the minimum security necessary to transmit, process and store cardholder information. Payment card information is a high-profile target and the tactics of cybercriminals are becoming more and more sophisticated. No organization is ever entirely secure; but with proper defenses, businesses can mitigate their risk and make it more difficult for cybercriminals to breach their private network.

Organizations of all sizes should blend compliance into ongoing operations. Security, by definition, involves safeguarding confidential information, protecting against fraud, ensuring systems are available so you can generate revenue, and making sure there are no errors in the stack. When you do all these things, you inherently wind up fulfilling the intent of all major regulatory and industry compliance regulations.

Going a bit above and beyond the periodic audits and network scanning required by PCI standards can yield a lot more value to an organization and, in most cases, does not add as much additional expense as may be perceived.

InfoSight provides a variety of tools, guidance, training resources and other IT security services to assist organizations seeking to achieve PCI compliance. We can help you build and maintain a high security posture, help you understand what is involved in PCI compliance, and assist in developing policies and practices that best fit your needs.

PCI compliance standards will continue to evolve over time. Contact us to help you build and maintain a high security posture while ensuring PCI compliance.

Complementary Services
IT Audit / Compliance Assurance Program
IT Risk Assessment
Enterprise Risk Management