Leveling Up to Meet the PCI DSS v4.0 Challenges
Jim Seaman
Business Information Security Officer (BISO) | Cyber Security & Risk Consultant | PCI DSS Compliance Specialist | Author | Speaker | MSc, CISM, CRISC, CDPSE | 20+ Years in Security Risk Management
Introduction
Great leadership and management teams understand the importance of helping their teams to manage their stress and pressure levels.
Delivering v3.2.1 level 1 assessments already came with high-pressure and stress. Now, the new PCI DSS v4.0 has opened up this tap and significantly increased the water flow.
Using Automation to Open Up the Taps
Let's face it, the expectation that assessors can manage their level 1 assessments, without the aid of technlogy, should now be consigned to history. To mitigate the additional evidence-focused practices and to reduce the human error risk, the assessors need access to suitable technological solutions that can bear the brunt of any additional admin tasks that are required, in the completion of the new Report On Compliance (ROC) template.
Calculating the Return On Investment (ROI)
When weighing up the 'Pros & Cons' of a technological aid, it is important to consider both the tangible and intangible aspects, e.g.,
Recommendations
If you have not done so already, research what technological aids are available to you to help simplify, automate (where practical) and harmonize your level 1 assessment practices, e.g.,
领英推荐
Consider your options, what challenges you are likely to face and how a suitable technological aid can help your team of assessors?
Conclusion
It might be tempting to struggle on with your level 1 assessments, using the analogue, manual practices. However, the PCI DSS v4.0 ROC template is going to add stress and pressures to your team, which will have an impact.
What will the potential impact be on your organization?
How are you planning to mitigate this impact?
Business Information Security Officer (BISO) | Cyber Security & Risk Consultant | PCI DSS Compliance Specialist | Author | Speaker | MSc, CISM, CRISC, CDPSE | 20+ Years in Security Risk Management
8 个月For example, think of the time-saving provided by a technological aid that can instantly update the Assessment Summary table (Part 1, Section 1.8.1) based on any changes made to the Assessment Findings in Part 2. In the first table, a ZERO in a checkbox is automatically converted into an unmarked checkbox and a ONE (or above) is represented by an X within the corresponding checkboxes. Have you thought about how much time you are going to work through a minimum of 431 pages (landscape) and cross-reference the 260 Assessment Findings back to section 1.8.1 of Part One of the ROC Template? I bet that it's going to be considerably longer than it being INSTANTANEOUS, through the use of automation. ??