Non-Compliance Lesson No. 4: Keep your head in the cloud when adopting new technologies

PCI DSS can be hard and not preparing for it just makes things harder. Following this advice is guaranteed to make it both more exciting and painful.

• Trust the vendor’s sales team that their sexy new tech is different and doesn’t need to comply
• Don’t do your due diligence on the potential security impact or access to sensitive information
• Act surprised when your QSA asks for the attestation of compliance (AoC) and PCI responsibility matrix for you new friends service providers or other evidence their solutions supports your compliance
• Exercise your right to audit clause (if you have one), and include your service providers inside your annual assessment at your cost
• Hope their compliance doesn’t rely upon a “secret sauce”
• Enjoy explaining to senior management why your assessment is delayed or worse
• New is sexy and different and the old rules just shouldn’t apply

Don’t get us wrong, many new technologies are great and can really improve security.  Much of it leverages cloud technologies. But just because it’s new and sexy doesn’t mean it gets a pass on PCI DSS.  Products and services must be fit for purpose and that includes supporting your regulatory obligations.  Many of these solutions directly impact security or may even access cardholder data. Here are some considerations for your due diligence:

• Shifting from on-premise products to off-premise third-party services.
• Offloading data for analysis
• Managing anything that can impact security
• New approaches must still comply, if they don’t do things the traditional way then they are obligated to document and prove how they meet these requirements

Some examples: next generation anti-virus and endpoint defense.

Learn More

Seriously, if you want your assessment to be smooth and boring you may find these articles useful.

• PCI DSS v4.0 Summary of Changes https://www.pcisecuritystandards.org/documents/PCI-DSS-Summary-of-Changes-v3_2_1-to-v4_0.pdf
• Reporting Requirements https://www.pcisecuritystandards.org/documents/PCI-DSS-v3_2_1-ROC-Reporting-Template.pdf  
• Third-Party Security Assurance and Shared Responsibilities https://docs-prv.pcisecuritystandards.org/Guidance%20Document/PCI%20DSS%20General/ThirdPartySecurityAssurance_March2016_FINAL.pdf
• PCI SSC Cloud Computing Guidelines https://www.pcisecuritystandards.org/pdfs/PCI_SSC_Cloud_Guidelines_v3.pdf
• Connected-to Service Providers https://www.pcisecuritystandards.org/documents/PCI-SSC-Connected-to-Service-Providers-Guidance.pdf
• All Known Published PCI FAQs indexed in one place https://controlgap.com/pci-frequently-asked-questions/
• FAQ #1312 https://www.pcisecuritystandards.org/faq/articles/Frequently_Asked_Question/If-an-entity-uses-a-service-provider-that-is-not-PCI-DSS-compliant-how-does-this-impact-the-entity-s-compliance
• FAQ #1065 https://www.pcisecuritystandards.org/faq/articles/Frequently_Asked_Question/Should-service-providers-demonstrate-PCI-DSS-compliance-as-part-of-their-client-s-assessment-or-in-their-own-separate-assessment
• FAQ #1369 https://www.pcisecuritystandards.org/faq/articles/Frequently_Asked_Question/Does-PCI-P2PE-allow-for-partial-assessments-of-third-parties-with-services-that-will-be-used-in-one-or-more-P2PE-solutions

If you'd like more entertaining reads, try these:

• Non-Compliance Lesson No. 3: Don't upgrade or patch your old stuff
  https://controlgap.com/blog/Non-Compliance-Lesson-No-3
• Non-Compliance Lesson No. 2: Outsource your payments/security and don't read the fine print
  https://controlgap.com/blog/Non-Compliance-Lesson-No-2
• Non-Compliance Lesson No. 1: Wait until your assessment to validate scope
  https://controlgap.com/blog/Non-Compliance-Lesson-No-1
• The ENTITY (a scary PCI monster)
  https://controlgap.com/blog/the-entity-a-scary-pci-monster

Original Publication: 2022-06-08
Updated PCI FAQ & Learn More links: 2023-06-16

If You Need Help

Compliance can seem as dry as toast. Normally, it only gets exciting when things go wrong like when you find problems during an annual assessment, facing a looming deadline, with senior management breathing down your neck expecting a pass. Last minute discovery of problems gets extremely stressful. Failure becomes an option. Remediation is not guaranteed and can often be risky, sub-optimal, and expensive.

PCI DSS has 12 high-level requirements and over 250 sub-requirements each of which is an opportunity for failure. The kinds of challenges we describe are often avoidable and manageable. After all, PCI is an open book exam and there should be no excuse for not being prepared. If you are struggling with business-as-usual compliance, or have challenges, we can help.