What is a CEO to do?
Meanwhile, CEOs are struggling to drive the business forward in a historically difficult operating environment, and often view the Infosec team as being an impediment rather than an enabler to the business. An ill tempered CEO who thinks his CISO isn’t getting the job done does not bode well for our industry as playing a game of musical chairs merely slows down security initiatives, thus defeating what were certainly good intentions. What makes this decision more difficult is that the CEO has little tangible insight as to whether organizational risk is trending up or down. Graph charts depicting a downtrend of critical findings from Nessus scans surely don’t tell a CEO much about how much risk has been mitigated. Fact is, based upon our observations there are very few CISOs who even know what they are protecting outside of PCI related assets.

Getting beyond the PCI scorecard
Within the current operating landscape, it’s incumbent upon CISOs (or equivalent in responsibility), to position within the organization that compliance is a shared problem between all parts of the business including IT operations, Security Operations, Human Resources, Legal, and Executive Leadership. It should further be made clear what exactly each part of the business is responsible for implementing, and hold all accountable. Finally, bringing effective communications supported by meaningful metrics to the subject are critical to help communicate throughout the leadership chain that residual risk is being appropriately managed and mitigated.

As for your next PCI assessment, unless you’ve consulted with your QSA to discuss changes made within the standard, it is wise to set expectations with varying levels of leadership that there will likely be findings that weren’t issues within previous years and to anticipate resource requirements accordingly.

I’m held accountable for maintaining PCI compliance, what should I do?

• The first thing we recommend to all who own compliance is to be prepared. For those that have not had a gap analysis against the latest version of the standard, expect findings and ensure enough time & budget is set aside to deal with them.
• The second recommendation we consistently make is to ensure that your program is fully operationalized and well documented. Nothing sets an assessors mind at ease better than well organized documentation and associated observations that demonstrate the rubber is clearly meeting the road.
• The third item we suggest is to put yourself in the assessors shoes. They have very little time relative to the job at hand, are feeling the pressure of doing an adequate job, and are being subjected to lawsuits when companies they assess are later breached. If you could switch sides at the table, how would you respond to what you are hearing?
• Finally, we recommend that a new approach to PCI compliance be adopted. Compliance failures are rarely attributed to technology limitations, but rather a breakdown in the required resources and/or associated methodologies required to truly operationalize requirements. It was this realization that prompted Alchemy Security to embrace project management methodologies such as Scrum. Scrum was originally designed to support agile software development, and what we realized is there is little difference between Agile Development and Agile Security. Borrowing concepts and metaphors from lean manufacturing frameworks, Scrum supports “just enough” project management to ensure a nimble process is in place to ensure ongoing compliance. Based upon our observations in the field, the Infosec community could greatly benefit from adopting more of these ideas to make compliance processes manageable, and the goal of remaining compliant between yearly audits attainable.