3 new certified QSA's reporting for duty.

In March, 3 of our Australia based employees became certified as Qualified Security Assessors (QSA’s) which doubles the number of QSA’s working for CQR covering Australia and New Zealand.

CQR have been a QSA company for a number of years and prides itself on having available QSA resources in each of their Australian offices.

Being certified as a QSA means that the PCI Security Standards Council has assessed each candidate to meet the requirements to perform a PCI data security assessment, and are able to validate a client’s adherence to the PCI DSS.

Why comply to PCI DSS?

For vendors who are responsible for the safe handling of cardholder information the PCI Data Security Standard (PCI DSS) is a key part which provides an actionable framework for developing a robust payment card data security process, including prevention, detection and appropriate reaction to security incidents.

Undertaking a PCI Security Standard can seem like a lot of effort, especially for those with smaller organisations, but the benefits out way those doubts. In an environment where data is valuable, showing compliance to PCI DSS lets customers know that your systems are secure and they can trust you with their sensitive payment card information. That trust allows your customers to be happy doing business with you and making confident customers they are more likely to become repeat customers or recommend you to others.

For other organisations doing business with you it shows that you are conscious about security and are active in looking after your data and that of others. Compliance is an everyday process and ensuring that you are up to date and meeting the standards guidelines is just as important. Being compliant can also help with other regulations that are out there.

Being compliant not only gives your customers and business partners confidence and peace of mind but it will also help your company to avoid the negative effects of compromised data, including loss of sales, relationships which can lead on to insurance claims, cancelled accounts, payment card and government fines. None of which any organisation wishes to encounter. This shows that the benefits of having a robust PCI DSS can benefit all organisation who deal with cardholder information.

CQR have proven success in supporting businesses through stages of their PCI journey and having additional PCI QSA’s ensures that the extra skills are available to achieve this.

Contact CQR today to see how we can help you achieve compliance today.

Sarah Taylor
www.cqr.com

Decline of the PCI empire

The Payment Card Industry Data Security Standard - PCI DSS - is a standard with 255 controls that you must comply with if you store, process or transmit credit card information.  Complying with the standard is the cost of doing e-commerce today.  The cost is high, and going to get higher, and as with all monopoly empires this increase will eventually lead to its downfall.

Disclaimer: CQR is a QSA company and I am a QSA.  I have no special knowledge about what the PCI council is going to do, so this is a fairly bold statement.  I base my assessment on simple economics.

PCI DSS v3.0 will be released in October 2013.  The only certainty is that it will have more controls, and they will be harder to comply with, and it will be more expensive both to implement and have audited.  Today most level 3 and 4 merchants are struggling with PCI.  Next year will break some of them - some will just fail to comply, and others will consider no longer taking credit cards.  Three years later, in October 2016, PCI DSS v4.0 will be released, and this will break the rest.

Don't get me wrong - PCI DSS is a good standard, it serves the purpose it was designed for, and if all merchants complied with it there would be far fewer credit card breaches.  But we need to go back to economic basics: if the cost of the control exceeds the value of the service, then it makes no economic sense to offer the service.  Somewhere around the release of PCI DSS v4.0 this will cross-over.

Here's my prediction for the inevitable decline: more and more merchants will stop taking credit cards directly.  PCI DSS only applies if you store, process or transmit credit card data.  So if merchants stop doing this directly, and instead use a third party service provider to process card data, they will no longer have a compliance burden.  Merchants will still have a cost to bear, as the service provider will need to be compliant, but that cost can be amortised over many more merchants, leading to the cost of the control dropping back below the value of the service, and economic theory prevailing.

We are going to keep taking credit cards because they are just too convenient.  But the market for PCI services is going to shrink radically, and in the end this is going to make all of us safer.

Phil Kernick Chief Technology Officer
@philkernick www.cqr.com