Download

274 Chapter 8 • Why PCI Is ImportantNOTEJust because a POS system is on the list of compliant payment applications,does not mean that your particular implementation is compliant. You shouldwork with the application vendor to verify this.If wireless technology is used within the cardholder data environment, or if the cardholderdata environment is not adequately segmented, separate procedures will have to beused to validate compliance. PCI Co does not consider wireless technologies to be sufficientlymature; therefore, they are treated with extra caution.For the benefit of consumers that may be more familiar with a brand name than aparent company, PCI compliance is validated for every brand name.Thus if a company hasseveral divisions or “doing business as” (DBA) names, each entity has to be validated separately.For reporting simplicity, the ROCs and SAQs may note that they include validation ofmultiple brand names.You may discover that sometimes it is necessary to bend the rules for a legitimate businessneed. For example, you may need to temporarily store cardholder data unencrypted fortroubleshooting purposes. As long as you follow reasonable precautions, card brands understandthis need. Another example may include recording certain call center conversations forcustomer service purposes. Again, card brands understand that these recordings may containcardholder data, so accommodations are made accordingly.In many cases, compensating controls have to be used to achieve compliance when yourcompany cannot meet a given requirement exactly.The important thing to remember aboutcompensating controls is that they have to go beyond the requirements of PCI to providethe same or higher assurance of cardholder data protection. When compensating controls areclaimed, additional documentation must be completed.The Compensating ControlWorksheet, which can be found in Appendix C of the PCI DSS Security Audit Proceduresdocument, must be filled out for each situation.Risks and ConsequencesIf you are a Chief Financial Officer (CFO) or a comptroller, you are probably asking thequestion:“Why would I need to spend the money on PCI?” Good question—there arefines! Unfortunately, the fine schedules are not well defined.Your company’s contract withthe acquiring bank probably has a clause in it that any fines from the card brand will be“passed through” to you. With all compliance deadlines passed, the fines could starttomorrow. Visa USA has announced that it will start fining acquirers (which will pass on thecosts to the merchant) between $5,000 and $25,000 per month if their Level 1 merchantshave not demonstrated compliance by September 30, 2007, and Level 2 merchants have not