Cut PCI Compliance and Audit Costs in Half

Seven steps to aggressively simplify and secure what really matters.

Do not fill in this field

Enter no text in this field

Do not enter text

Get Instant Access
to this Blueprint

Full Name

Company

Phone

Job Title

Unlock This Blueprint

View Storyboard

Contributors

Morgan and Pottinger
ALON USA
Service Repair Solutions Inc.
East Central Energy
City of Calgary

Your Challenge

Many merchants still have not addressed their PCI compliance obligations, or if they are currently in the middle of the process (or even completed it), are unaware of how to do it in a cost-effective way and get bogged down in the details.
Organizations need to understand the options available to them to simplify PCI compliance while still meeting the criteria.

Our Advice

Critical Insight

Organizations need to realize that focusing on compliance over security doesn’t actually address the risks they face.
The focus should be on securing what is absolutely necessary, which means that holding onto credit card information may not be required.
PCI compliance is not just about technology. Organizations need an action plan that combines technology, policy, and training and awareness to ensure compliance success.
PCI does not just belong to one department – it is an organization-wide responsibility, from finance, to IT, to employees who are at the forefront of actually handling the transactions.

Impact and Result

Understand what your organization needs in regards to achieving PCI compliance, and use that information to find opportunities to simplify.
Creating an action plan that involves all related parties ensures that everyone starts off on the same page and cooperatively tackles compliance as a team, rather than disjointed parties. Organizations will find more success with a group effort.

1. Understand the importance of becoming PCI compliant

Understand the effects of remaining non-compliant, and what it costs to reach compliance.

2. Record compliance-related information and identify opportunities to do compliance better

Use the capture tool to identify gaps and opportunities, as well as specific strategies that work best with your organization’s requirements.

3. Review 12 PCI Core Requirements

Review each requirements and the key actions you need to take to address them.

4. Determine Simplification Strategy and Communication Plan

Create a communication document to properly inform stakeholders and secure their buy-in. Document and maintain all PCI related information in one central location.

Guided Implementations

This guided implementation is a four call advisory process.

Call #1 - Evaluate your current state

Know what you are working with: Do you know where your security policies are? How about past audits completed? Understanding what your organization is doing in regards to compliance, even if you’re not in IT, is vital to your compliance success.

Call #2 - Understand PCI requirements & prioritize your compliance gaps

PCI has 12 core requirements surrounding recommendations for topics like firewalls, maintaining a security policy, and more. Map your problem areas to these requirements to determine gaps.

Call #3 - Identify your PCI simplification strategies

Now that your priorities are established, it’s time to discuss what your next steps are in achieving compliance in your gap areas. We’ve broken it down into four tactic areas that will address your compliance needs.

Call #4 - Build a Simplification Launch Plan

Communicating PCI compliance to the broader organization is almost half the battle. Prepare a communication plan for stakeholders, and training and awareness for employees, to ensure everyone is on the same page.

Book Your Workshop

Onsite workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost onsite delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

Module 1: Evaluate your current state and gap analysis

The Purpose

After completing this section, you will understand:

The goals you have established in relation to this project.
What’s a stake if you do not prioritize PCI compliance.
Your current state in relation to PCI and security policies and procedures.
The gaps that are preventing you from being successful at compliance.

Key Benefits Achieved

You will identify key opportunities within policy and procedural gaps to improve compliance practices.

Activities

Outputs

1.1

Getting started and goal setting

PCI compliance goals

1.2

Evaluate your current state

Sneak Audit

1.3

Map 12 PCI core requirements to your current state

PCI Simplification Action Plan

Module 2: Determine Simplification Strategy & Communication Plan

The Purpose

After completing this section, you will understand:

The gaps that exist in relation to the 12 PCI requirements.
A prioritization plan on how to tackle the gaps.
How to effectively communicate PCI processes to stakeholders and employees.
How to document and maintain PCI related information in an Action Plan.

Key Benefits Achieved

Having completed this module, you will be able to:

Track gap remediation progress, and have a process in place to identify gaps on an annual basis.
Communicate any changes related to PCI to key players and obtain buy-in.
Train employees to effectively handle and manage transactions and PCI-related information.

Activities

Outputs

2.1

Complete gap prioritization

PCI Simplification Strategy

2.2

Identify PCI simplification strategy

PCI Simplification Action Plan

2.3

Develop a PCI Simplification Launch Plan

Communication Plan
Training and awareness resources

After each Info-Tech experience, we ask our members to quantify the real time savings, monetary impact, and project improvements our research helped them achieve. See our top member experiences for this Blueprint, and what our clients have to say.

Client

Experience

Impact

$ Saved

Days Saved

Testimonial

Chatham County, GA

Guided Implementation

9/10

N/A

Plumbing Distributors

Guided Implementation

10/10

$31,833

Best parts: 1. Analyst was willing to change the agenda after clarification of my end goals. 2. Analyst did a superb job at identifying items like each requirement of an employee should have its own indepedent initials for acceptance validation. 3. Analyst has superior knowledge in PCI DSS security practices and audits. Worst Part: 1. I wish the infotech document library had more example policies for search/replace documents for security generic policies for the IT department.

The Leading Hotels of the World, Ltd.

Workshop

6/10

N/A

City Of Airdrie

Guided Implementation

10/10

$8,000

We were heading down the path of a complete environmental scan and the information set us on the path to put most of the workload on the vendors.

First Citizens Bank Limited

Guided Implementation

8/10

$12,733

None to report

First Citizens Bank Limited

Guided Implementation

9/10

N/A

Festival Foods, Inc.

Guided Implementation

8/10

$63,667

Everything was great, just not enough detail to guide us. Not a reflection upon Sean, it is about the PCI business itself.

Advantix Solutions Group

Guided Implementation

10/10

N/A

Palmer College of Chiropractic

Guided Implementation

10/10

N/A

lots more work i need to do now. Thanks for helping me!

University of Calgary

Guided Implementation

10/10

N/A

Tedeschi Food Shops, Inc.

Guided Implementation

1/10

N/A

These comments are not meant to be negative. The analyst was very helpful and knowledgeable. However, it turns out that we had already reviewed the documents available to us from Info-Tech in this area and we were also already aware of PCI requirements and what we could do to reduce the scope of PCI within our company. As a result, while the engagement confirmed for me that Info-Tech is a valid resource in this area, the progress we had made on our own was such that the discussion with the analyst did not provide additional value.