Working at MasterCard and Visa level 1 service providers, I’ve been asked for my “PCI Certificate” on a regular basis. But in the PCI DSS world, there is nothing called a PCI Certificate. So what’s really being requested? Ultimately, a PCI compliance certificate would be a piece of evidence showing that a company complies with…
Category: Blog
The Best PCI DSS Advice
With 20 year’s experience in the card processing space, I’ve seen PCI DSS evolve from its earliest days to its current form. In that time I’ve worked with lots of outside companies as clients and service providers. PCI DSS is sometimes thought of as a very strict standard, one that takes a prescriptive approach on…
Cloud logging services and PCI DSS
It’s a common question: Can I use cloud logging services for PCI DSS? And if so, which cloud providers should I use? The short answer: since you can use cloud providers like AWS and Azure to host your core cardholder data environment, the answer is ultimately yes. You can oursource log management to cloud providers.…
PCI Calendar – Service Provider Edition
Previously, I discussed the importance of establishing a PCI DSS compliance calendar. This lets you to identify and track all the recurring tasks that must be done to stay compliant with the PCI DSS. As that article touches on, an important distinction in PCI compliance is whether you’re a service provider, or another type of…
Creating a Calendar for your PCI Compliance Schedule
Many people approach PCI DSS compliance as a once-a-year activity. They get close to the day of reckoning, when their QSA comes on-site. Or they realize that it’s time to fill in the SAQ again. They fix a bunch of issues they became aware of over the year. They hope they’ve checked the boxes, and…
PCI DSS v4.0 draft released
The first draft of PCI DSS v4.0 is now available to stakeholders for comment. If you’re an accredited stakeholder, be sure to get your comments in before 13 December. But if you’re not such a stakeholder (perhaps even if you are!), consider this: the PCI DSS has a good claim to be the information security standard…