 |
|
|
| > |
QUESTION POSED ON: 25 January 2008
If there is supposed to be a consolidated security standard among American Express, Visa and Mastercard, why are there still independent security programs that you have to follow for each vendor? For example, AmEx has its DSOP that has to be followed.
|
|
|
To continue reading for free, register below or login
To read more you must become a member of SearchSecurity.com
The Payment Card Industry Data Security Standard (PCI DSS) is that consolidated standard that you refer to. Yet, it is perceived to be a minimum level of security required to protect private customer data. Each of the major credit card issuers reserves the right to build additional security requirements on top of PCI DSS.
This is not a bad thing because as we all know, PCI DSS is not the end-all and be-all for security. It's true that it's the most specific and therefore most useful of the standards for compliance, but it's by no means foolproof. I've long held that organizations should stay focused on security and not compliance. If a company is doing a good job on security, then in all likelihood it will be compliant with most regulations.
American Express' Data Security Operating Policy (DSOP) (pdf) isn't really another set of requirements to follow. Rather, the DSOP clarifies AmEx's expectation of documentation and scanning for merchants of a certain size. Amazingly enough, the transaction volumes roughly equate to the way retailers are tiered into specific levels for PCI DSS.
The DSOP also specifies the ramifications of not promptly notifying AmEx of a potential breach. There is a lot of legalese in this section, but the gist is that AMEX will rake a company through the coals if it doesn't quickly and fully disclose a potential data breach. This is consistent with the overarching PCI DSS focus on pushing the liability of data breaches down to the retailers.
More information:
|
|
|
|
|
|
|
|
Search and Browse the Expert Answer Center
Search and browse more than 25,000 question and
answer pairs from more than 250 TechTarget industry experts.
|
|
|
|
|
|
|
|
|
|
|
|
