1. Burton Group Take 5! The PCI Half-Dozen: 6 Recommendations for PCI Compliance Diana Kelley, VP & Service Director March, 2007

2. The PCI Half-Dozen
It’s 5pm – do you know where your credit card numbers are?
“BJ'S Wholesale Club Settles FTC Charges”
~Thousands of credit and debit card numbers
“Customer Data Breach Began in 2005, TJX Says”
~card numbers impacted?– still investigating
“CardSystems' Data Left Unsecured”
~40 million card numbers impacted

3. The PCI Half-Dozen Data element Storage permitted Protection required
PCI DSS Requirement 3.4
Cardholder data
PAN
Yes
Cardholder name No
Service code
Expiration data
Sensitive authentication data
Full magnetic stripe
N/A—Storage not allowed
CVC2/CVV2/CID
PIN/PIN block
Covered Data Elements (Data Source: PCI DSS Version 1.1, September 2006)

4. The PCI Half-Dozen Get the Facts
Go to the source – the PCI Data Security Standard and the PCI DSS Security Audit Procedures
Self assess – uncover and remediate gaps in advance
2. Segment the Scope 
PCI DSS applies to the cardholder data environment
Reduce scope through zoning and segmentation
3. Don’t Store What You Don’t Need
No Track II/Sensitive Auth Data!
But do you need the Cardholder data at all?

5. The PCI Half-Dozen 4. Be Prepared and Be a Partner
Work with Qualified Security Assessors (QSA) or in-house assessors
Agree on the scope up-front
Prepare supporting documentation – including for compensating controls
Build remediation plans – and follow them
5. Get Involved
Changes were made between v1.0 and v1.1 in part, due to feedback
Merchants and Payment Service Providers can become “Participating Organizations” of the SSC
6. Build a Compliance Program
Compliance is about more than PCI
Take a long-view approach to compliance as a whole

6. Thank you! For more information:
Burton Group Security and Risk Management Strategies Overview – “What and Why PCI? Inside the Payment Card Industry Data Security Standards,”
The PCI Security Standards Council,
Payment Card Industry (PCI) Data Security Standard, Version 1.1,
PCI DSS Security Audit Procedures,