This is not a bad thing because as we all know, PCI DSS is not the end-all and be-all for security. It's true that it's the most specific and therefore most useful of the standards for compliance, but it's by no means foolproof. I've long held that organizations should stay focused on security and not compliance. If a company is doing a good job on security, then in all likelihood it will be compliant with most regulations.
American Express' Data Security Operating Policy (DSOP) (pdf) isn't really another set of requirements to follow. Rather, the DSOP clarifies AmEx's expectation of documentation and scanning for merchants of a certain size. Amazingly enough, the transaction volumes roughly equate to the way retailers are tiered into specific levels for PCI DSS.
The DSOP also specifies the ramifications of not promptly notifying AmEx of a potential breach. There is a lot of legalese in this section, but the gist is that AMEX will rake a company through the coals if it doesn't quickly and fully disclose a potential data breach. This is consistent with the overarching PCI DSS focus on pushing the liability of data breaches down to the retailers.
Dig Deeper on PCI Data Security Standard
Related Q&A from Mike Rothman
Pirated software is still a major concern nowadays. Uncover how to prevent software piracy and protect your organization's intellectual property. Continue Reading
While liaison officer responsibilities vary depending on the company they work for, their strong organizational and communications skills make them ... Continue Reading
The CISSP certification can be a challenge to obtain. Mike Rothman unveils how to get on the right education and career tracks in order to get CISSP ... Continue Reading