Vendor alliance wants PCI certification program |
 |
By Michael S. Mimoso, Editor, Information Security magazine
05 Feb 2007 | SearchSecurity.com and Information Security magazine |
|
|
Enterprises clamoring for PCI-certified products and services are a somewhat closer to having their wish fulfilled.
The Payment Card Industry Security Vendor Alliance was announced this week at RSA. The mission of its five founding members--Configuresoft, Protegrity USA, SafeNet, Proginet and Cyber-Ark--is to provide guidance on the products and services that can be used to achieve compliance with the PCI Data Security standard(PCI), and ultimately get a PCI certification program off the ground.
PCI is a standard that dictates how credit card merchants must protect cardholder information. It applies to merchants that store, process or transmit cardholder information. Merchants that don't live up to the standard's 12 requirements run the risk of not being able to do business with the leading credit card companies, Visa, MasterCard and American Express.
|
|
|
|
|
By educating the community about the technology and services available to automate compliance, merchants will be able to achieve compliance sooner.
David Taylor
VP of Data Security Strategies, Protegrity USA
|
|
|
|
|
|
|
|
|
|
PCI SVA member Chris Farrow, director of Configuresoft's Center for Policy and Compliance, said merchants are struggling to comply, in part because the PCI Security Standards Council has not invited vendors to join its ranks, nor does it certify products. The council was founded by the leading credit card providers. Farrow hopes the formation of the SVA, which made a full call for participation this week at RSA, earns vendors a seat on the council. The council currently certifies PCI assessors and scanning vendors, and Farrow said that framework is a good start for a product and services certification program.
"We realize that's the tougher part of the mission. But customers have no guidance in picking vendors," Farrow said. "We'd like some endorsement--a warm-and-fuzzy--that says 'we've seen your work and it's viable if implemented.' "
The founding members said SVA will provide educational and advisory services to the payment card industry via its site www.pcialliance.org, analyst briefings, conference presentations and live seminars.
"By educating the community about the technology and services available to automate compliance, merchants will be able to achieve compliance sooner, and therefore receive the overall business benefits of compliance earlier in the process," said David Taylor, VP of Data Security Strategies at Protegrity USA.
<< Return to our special coverage of RSA Conference 2007
|
|
|
|
