BUSINESS CLARITY ™ PCI – The Pathway to Compliance

BUSINESS CLARITY ™ 2 Proprietary and Confidential – Do Not Distribute Agenda What is PCI? Why PCI is Different From Everything Else Who Must Comply With PCI? Costs of a Data Breach How Do We Become Compliant? Tools to Help Get You There

BUSINESS CLARITY ™ 3 Proprietary and Confidential – Do Not Distribute What is PCI? The major credit card issuers created PCI (Payment Card Industry) compliance standards to protect personal information and ensure security when transactions are processed using a payment card. The PCI standards are divided into six categories:  Maintain a secure network  Protect cardholder data  Maintain a vulnerability management program  Implement strong access control measures  Regularly monitor and test networks  Maintain an Information Security Policy

BUSINESS CLARITY ™ 4 Proprietary and Confidential – Do Not Distribute What is PCI?(cont.) There are four PCI merchant levels, based on the number of transactions processed per year:  Level 1 merchants process over 6 million transactions  Level 2 merchants process between 1 million to 6 million  Level 3 merchants process between 20,000 to 1 million  Level 4 merchants process less than 20,000 Compliance validation requirements vary based on a business’s merchant level, with level 1 requiring a report on compliance by a Qualified Security Assessor, and all other levels completing a Self- Assessment Questionnaire Level 2 and 3 merchants also require quarterly network scans by an Approved Scan Vendor and a completed Attestation of Compliance Form.

BUSINESS CLARITY ™ 5 Proprietary and Confidential – Do Not Distribute Why is PCI Different From Everything Else? PCI is not risk-based like SOX – it is a prescriptive-based approach to security  PCI requires security patches applied every 30 days, where SOX let’s the company determine how frequently to patch  PCI does not leave much wiggle room for companies PCI does not accommodate risk acceptance  All security deficiencies must be addressed and remedied  Management cannot determine that a low or medium level of risk is acceptable to the company PCI does not recognize compensating controls  In risk-based security, strengths in one area can make up for low level deficiencies in others; this is not the case with PCI

BUSINESS CLARITY ™ 6 Proprietary and Confidential – Do Not Distribute Who Must Comply With PCI? All members of the payment card industry (financial institutions, credit card companies, and merchants) must comply with these standards if they want to access credit cards. Failure to meet the standards can result in fines from banks and credit card companies, and the loss of credit card processing privileges.

BUSINESS CLARITY ™ 7 Proprietary and Confidential – Do Not Distribute What Could a Data Breach Cost Us? Largest consumer credit card data theft: TJ Maxx lost over 45 million customer credit card records. The company had to set aside $250,000,000 to cover losses, but researchers have determined that they could be on the hook for over $1 billion.  All it took was a laptop and a directional antenna, and thieves were able to crack the security on the WiFi at a single store. From there, they were able to get enough data to compromise the central customer database. Hannaford, a grocery chain, had data stolen on 4.2 million credit card accounts by malware that their attackers installed on more than 300 company servers in at least six states.  Within 3 weeks of reporting the breach over 1,800 cases of fraud had been linked to the data theft, averaging exposure of over $100k per case.  In addition, 2 class action lawsuits are pending against the company. Damages in class action suits are not limited.

BUSINESS CLARITY ™ 8 Proprietary and Confidential – Do Not Distribute How Do We Get Compliant? Determine the security validation requirements based on your merchant level Determine what types of credit card information you capture, how long it is kept, and compare to actual business needs Make certain you have a very technical, security-focused auditor on your PCI compliance team  A CPA or non-technical IT auditor will typically find PCI compliance difficult, because of the extremely technical requirements Walk through the Self-Assessment Questionnaire fearlessly and with eyes wide open Get top-level management/Board of Directors on board from the outset, to ensure funding and support for the compliance initiative

BUSINESS CLARITY ™ 9 Proprietary and Confidential – Do Not Distribute Tools To Help You Get There: The PCI Compliance Checklist

BUSINESS CLARITY ™ 10 Proprietary and Confidential – Do Not Distribute Our Blue-Chip Customer Base

BUSINESS CLARITY ™ 11 Proprietary and Confidential – Do Not Distribute Thank You