Evan Schuman's StorefrontBacktalk

I run an annual PCI workshop for the Treasury Institute for Higher Education. We have a PCI deep-dive session, but the greatest benefit comes from the case studies presented by the people who manage their organization’s compliance efforts. They describe what they did to become compliant and what it cost in both time and dollars, in addition to their mistakes and victories. We get great support from the PCI Council, and with the help of industry sponsors we manage to keep the cost surprisingly low. Attendees also love the opportunity to network with others who are facing the same challenges .

My holiday wish to industry and trade associations everywhere, therefore—you know who you are, because we all were in the same room at the PCI Community Meeting when I spoke about this topic—is to add value to your members by offering this valuable PCI training. The Institute’s workshop is not perfect, but I would be happy to share the approach, agenda and anything else to provide a starting point.

Lest you think I am ignoring the merchants, I have a wish for all Level 2 merchants: Get started with your compliance validation now. As every Level 2 merchant should know, MasterCard requires a new validation regime to be completed by June 30, 2011, focusing on an outside assessment of your PCI compliance.

Level 2 merchants can meet this requirement one of three ways: Have a QSA prepare a Report on Compliance (ROC); send someone to the Council’s Independent Security Assessor (ISA) training and have them sign your Self-Assessment Questionnaire (SAQ); or hire a QSA to sign your SAQ. The choice is yours. But whichever path you choose, my wish is that you get started right away.

June will arrive quickly. If your company doesn’t have any ISAs on staff and you choose that route, I suggest you check the PCI Council’s Web site daily so you can register quickly once the classes are announced (Hint: Maybe a Council RSS feed for training classes would be a good idea, too.). These classes are popular, and they fill up fast, so don’t delay.

Alternatively, if you decide to have a QSA involved, start the search and contracting process early. I can just about guarantee a QSA—or an ISA—will question the compliance of some practices and you will have to do some remediation work. All of this takes time, and that is the one commodity you won’t have. My wish for Level 2 merchants everywhere, therefore, is that they have their validation plan in place before they get to go on any holiday break.

My final wish is for merchants of all levels to get more involved with the PCI Council. If you are not already a Participating Organization, consider joining. You will get advance notice of changes and developments, the opportunity to have your voice heard and the chance to join a Special Interest Group. Plus, you even get a discount on training (see above).

Like hopeful children everywhere, I don’t expect to receive everything on my list. But I hope that I will get at least some of my wishes. If I do, it will be a much happier holiday season next year—not just for me, but for everyone in the PCI ecosystem: retailers, brands, associations and the Council.

What do you think? I’d like to hear your thoughts. Either leave a comment or E-mail me at wconway@403labs.com.