MasterCard adjusts PCI compliance requirements

By Marcia Savage | Jul 1, 2009

0 comments

Facebook

LinkedIn

Digg

A recent change in MasterCard Inc's PCI compliance requirements means merchants processing between one million and six million transactions annually will likely have to spend more time and money on PCI compliance.

Under the new rules, Level 2 merchants must hire a PCI-approved auditor to complete an annual onsite data security assessment by Dec. 31, 2010. Previously, those merchants were only required to complete an annual self-assessment questionnaire in order to comply with MasterCard's Site Data Protection Program. The Payment Card Industry Data Security Standard (PCI DSS) forms the baseline for MasterCard's Site Data Protection Program.

The changes were announced in MasterCard's Global Security Bulletin on June 15 and distributed to MasterCard acquirers and processors, according to Chris Monteiro, spokesman for the Purchase, N.Y.-based company.

"The current enhancement of validation requirements for PCI compliance provides for independent third-party review, enabling consistency of application and implementation of DSS requirements," Monteiro wrote in an email.

MasterCard estimates fewer than 2,000 merchants will be directly affected by the revised rules. The onsite assessment must be conducted by a Qualified Security Assessor; the PCI Security Standards Council governs training and approval of QSAs.

Diana Kelley, founder and partner at consulting firm SecurityCurve, said onsite assessment aren't cheap; prices vary significantly depending on the number of locations that need to be assessed.

"Even though it's going to cost Level 2s money -- and most likely time too -- I think it makes sense to have them go through an on-site independent assessment," she said. "Self-assessment is fairly tricky. It's easy to overlook something significant in your own environment."

Indeed, when VeriSign QSAs are called in to review a self-assessment questionnaire (SAQ), they find a lot of mistakes, said Branden Williams, PCI practice director at VeriSign Inc.

"They just don't have the experience and don't really know how to answer some of the questions," he said. "And it can cause companies to spend a lot more money on remediation than they need to."

0 comments

Facebook

LinkedIn

Digg