Evan Schuman's StorefrontBacktalk

A 403 Labs QSA, PCI Columnist Walt Conway has worked in payments and technology for more than 30 years, 10 of them with Visa.

As we enter the holiday season, it seems like a good time to put together my holiday PCI wish list. Unlike most lists you may receive, I am targeting each of my wishes to a particular party. And because it seems like a shame to exclude anyone, my PCI wish list includes card brands, trade associations, certain retailers and, of course, the PCI Security Standards Council itself.

It makes sense to start at the top, so I would like to ask the PCI Council to publish a full, one-year schedule of training sessions. The Council’s training programs are excellent. Because of that, they are very popular and fill up quickly. As of this writing, the Council has not yet posted future training classes on its Web site. When that list is posted, my wish is that it be a complete schedule for all 2011 courses.

Planning a year out is difficult, and certainly I would understand or even expect changes to meet demand. But a full year’s schedule lets merchants (and QSAs!) make plans and budget for the session and location that is best for them.inflatable double slip and slide with pool

I’ll risk being greedy by asking for a second present from the Council: an RSS feed on the Frequently Asked Questions (FAQ) page. The FAQ section of its new (and very informative) Web site addresses many questions for merchants and QSAs, and the Council committed at the recent Community Meeting to update it regularly. Unfortunately, most retailers and their QSAs cannot check the Web site for updates every few days.

The need for an RSS feed was raised at the 2009 Community Meeting in Las Vegas and again at the 2010 meeting. Many of us subscribe to Visa’s RSS feed, which offers a choice of security- and PCI-related topics. Perhaps this could be a model?

Speaking of card brands, I have a wish-list item for them, too. It is one that will benefit thousands of retailers and other merchants. I wish brands would update the contract provisions of their new connected processors to make it easier for customers to comply with PCI DSS.

I’m referring to Requirement 12.8.2, which requires merchants to “maintain a written agreement that includes an acknowledgment that the service providers are responsible for the security of cardholder data the service providers possess.” That merchants have difficulty meeting this requirement is not new news and hasn’t been new news in quite some time. What is new is that merchants continue to have difficulties even when their processor is now connected to a card brand.

Therefore, my wish is for card brands everywhere to have any processing operations revise their contracts immediately to include language that complies with Requirement 12.8.2.

My holiday wish for the industry associations is to have them do more to help their members become PCI compliant. The PCI Council’s training programs are excellent, but they only go so far. They deal with PCI in the abstract. What merchants need is training that builds on the Council’s programs with more industry-specific, hands-on case studies of how real live merchants—retailers, restaurants, convenience stores, gas stations, hotels and software providers—implement PCI compliance.