How To Sell PCI To Business Units
Written by Evan SchumanGuest Columnist David Taylor is the Founder of the PCI Knowledge Base, Research Director of the PCI Alliance and a former E-Commerce and Security analyst with Gartner.
At this week’s National Retail Federation CIO conclave, NRFtech, the CIO of J.C. Penney presented the keynote, which focused on the top five priorities for the business and the technical implications of these priorities. PCI compliance, perhaps not surprisingly, was one of these top five priorities.
During the discussion, the CIO, Thomas Nealon, commented that one of the biggest challenges when it comes to PCI is explaining to businesspeople why it’s a priority. This is a common refrain among merchants of all types and sizes. Because there are a lot of examples of this in the Knowledge Base, I thought we could discuss some of them, so that others may be able to use them in their own companies.
However, like crying "Wolf," or talking about the end of the world, this only works for a short period of time. In addition, the use of this tactic can backfire if someone decides to cite the latest financial results from TJX as "proof" that security breaches have no discernable negative impact on revenues. So, although fear of a security breach can get business people to come to a meeting, you’ll need a "second act" to keep them in their seats.
Another tactic we’ve seen used effectively is to talk about the marketing value of being a PCI leader. Although PCI compliance doesn’t make for exciting TV advertisements, making sure customer service representatives—as well as sales and marketing—can explain to customers how their data is secured is a handy message to help get businesspeople to connect PCI with customers.
But it’s still necessary to get line management to care, because they have to make changes to business processes, re-train staff, etc. Working with Internal Audit can facilitate this process, because they usually report to the CFO. Some of the best "perpetual PCI" solutions we’ve seen involve Internal Audit, working with IT security for added technology cross-training, serving as the "big stick" to get business departments and store management to make PCI a top priority.
Selling PCI to the PMO is typically done by the CFO or COO as a delegation, but it can also be handled via a subtle handoff of a "high visibility, high reward" program. The PMO is a good organization to work with in the early stages of PCI compliance, but the job needs to be shifted elsewhere (Internal Audit or Information Security or Business Operations) after that.
Technologists are often at a loss when it comes to convincing businesspeople to change how they run the organization. This is not to say it cannot be done, but it’s much better if the IT organization can enlist the aid of the PMO and/or Internal Audit to work with the business people on addressing the operational implications of PCI.
By the way, if you’re a retailer, we want to get you involved in the best practices study we’re doing for the National Retail Federation. If you’d like to participate, send me an E-mail at David.Taylor@KnowPCI.com.
Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code.
-Marc
