PCI Security Standards Council Steps Up Collaboration for Data Security Standards
The PCI Security Standards Council (PCI SSC), an independent industry standards body providing management of the Payment Card Industry Data Security Standard (DSS) on a global basis, has announced that it has implemented formal channels for stakeholders to contribute to the organization and development of data security standards.
As part of its commitment to collaboration, the council announced it will be holding a community meeting in Toronto, Canada on September 17-19th. The three-day meeting will give participating organizations and PCI SSC approved Qualified Security Assessors (QSAs) and Approved Scanning Vendors (ASVs) the chance to interface with Council executives and committee members and to hear perspectives from representatives from across the payment chain on their direct experience in the field."The Council is looking forward to three days of active discussion and learning with our stakeholder community," said Bob Russo, general manager, PCI Security Standards Council. "This direct interaction is the basis for our commitment to ongoing collaboration with the broader payment community."
The Council also announced the start of the feedback gathering process for the PCI Data Security Standard. This week, participating organizations will receive materials to solicit feedback on the underlying requirements of the current standard and Self Assessment Questionnaire (SAQ), due late June. The Council hopes to shape the next generation of data security standards through engagement with PCI SSC stakeholders, to reflect the changing landscape of security threats, technology advancement and implementation realities. The Council plans to present an overview of the findings from the PCI DSS feedback process, and solicit active discussion at its Toronto meeting.
The Council also indicated that voting had begun as part of the recently initiated Board of Advisors election process and that the results for the 14 community appointed seats would be made publicly available in June. The Board of Advisors will represent the current roster of nearly 200 PCI SSC Participating Organizations, and moving forward will provide strategic and technical guidance to the PCI Security Standards Council, reflecting the varied perspectives of different global stakeholders.
"Our Board of Advisors will provide a great resource for helping us further evolve data security standards and we welcome their continued input for shaping the future of payment security," said Russo.
For More Information:
If you would like more information about the PCI Security Standards Council or would like to become a Participating Organization so that you can attend the upcoming PCI SSC community meeting, please visit pcisecuritystandards.org, or contact the PCI Security Standards Council at info@pcisecuritystandards.org.
About the PCI Security Standards Council
The mission of the PCI Security Standards Council is to enhance payment account security by fostering broad adoption of the PCI Data Security Standard and other standards that increase payment data security.
The PCI Security Standards Council was formed by the major payment card brands American Express(R), Discover Financial Services, JCB, MasterCard Worldwide and Visa International to provide a transparent forum in which all stakeholders can provide input into the ongoing development, enhancement and dissemination of the Data Security Standard. Merchants, banks, processors and point of sale vendors are encouraged to join as Participating Organizations.






I think it's a positive move by the council to open up to receiving contributions to both the organization and development of DSS. Adhering to the PCI DSS is somewhat proving to be overwhelming to some companies, especially when they do not understand the full implications of non-compliance. One can easily get lost (and confused!) browsing through the vast amount of info currently available on PCI DSS online… although some whitepapers available can be rather helpful in demystifying this whole issue. Two of my favorites are PCI DSS Made Easy (http://www.gfi.com/whitepapers/pci-dss-made-easy.pdf) and the 'official' glossary (https://www.pcisecuritystandards.org/pdfs/pci_dss_glossary_v1-1.pdf) which is a gem in guiding you through the terminology.
Posted by: Sara | May 24, 2007 at 04:00 AM