On Friday, the PCI Security Standards Council published a set of guidelines for organizations looking to get a handle on risk assessment and threat identification. Specifically, the guidelines relate to section 12.1.2 of the standard, and are drafted to act as a supplement to help businesses discover vulnerabilities and other threats to payment card data.
PCI DSS Requirement 12.1.2 requires organizations to establish a formal process for identifying threats and vulnerabilities that could impact the security of cardholder data. The thought is that by performing this risk assessment, businesses are better equipped to determine the appropriate controls for reducing the likelihood and/or the impact of potential threats to their business.
“As there are a number of risk assessment methodologies out there, our stakeholders were looking for guidance on how to effectively apply these principles to their organizations to meet PCI requirements,” said Bob Russo, general manager, PCI Security Standards Council.
The guidelines were developed by more than 60 organizations representing banks, merchants, assessors, and vendors. According to the PCI Council, the supplemental data outlines the relationship between PCI DSS and risk assessments; “…the various industry-recognized risk methodologies and key components of a risk assessment, including developing a risk assessment team and building a risk assessment methodology; risks introduced by third parties; as well as the risk reporting process and critical success factors.”
The key points from the document itself center on the need for continuous risk assessments, and that said risk assessments must not be used as a means of avoiding or bypassing PCI DSS requirements.
“Any organization that stores, processes, or transmits cardholder data can benefit from this guidance, including merchants, service providers, acquirers (merchant banks) and issuers,” the Council said.
The guidance can be downloaded here, but remember, If PCI is your whole security program, you’re not doing your job right.
