This is page 2 of:
Should Retailers Use PCI Training To Enhance—Or Replace—Their QSA?
Some merchants will see the benefits as reducing or even eliminating various QSA costs. Merchants need to assess how significant the QSA’s professional fees are in relation to the total cost of a PCI assessment. Often, the infrastructure costs and dedicated internal resources–including the newly trained Auditors–are a large part of the total cost. In addition, merchants still need internal and external penetration tests, the costs of which can be a major part of a QSA engagement. Remember, too, your quarterly external vulnerability scans still need to be conducted by an Approved Scanning Vendor (ASV).
Second, let’s look at the product: the assessment itself. The PCI DSS is complex, and QSAs live in it. QSAs regularly call on their colleagues to review findings, discuss interpretations, seek advice and craft compensating controls. QSA firms have a formal quality assurance process for each document or Report on Compliance (ROC) that goes out. One or even several Internal Auditors with limited exposure to PCI (how many are conversant in encryption key management, firewall rules or certificate authority?) and few colleagues to talk with will lack these advantages.
PCI is about protecting the enterprise. This point brings up an awkward organizational issue: Will Internal Audit be able, politically, to deliver the occasional difficult news that a technical or business process has to be changed? If this ability cannot be guaranteed, the merchant may be validated, but it will not be compliant. And it certainly will not be secure.
A reasonable middle ground is that Level 1 and Level 2 merchants will use the Merchant QSA training to leverage an existing QSA relationship. For example, the document gathering phase of an assessment might be compressed and the onsite visit(s) might be conducted quicker and more effectively. Compensating controls can be drafted internally.
Such an approach can save QSAs time. The Internal Auditor also gets valuable on-the-job PCI training by working closely with an experienced QSA and bouncing ideas around with that person. The QSA has been through the assessment process before and has a lot of experience to share. (Hint: The ability to work with their staff and “teach” PCI may be something merchants should consider when seeking their QSA.)
The question for Level 1 and Level 2 merchants should not be whether to send their staff to the PCI Council’s Merchant QSA training. That is a no-brainer. I hope every merchant sends people to this course, or at least to the current merchant training. It would be great to see those courses so full that the Council has to schedule additional sessions. There is not a QSA on the planet who doesn’t want a knowledgeable, PCI-savvy merchant as a client.
I’d like to hear what you think. Have you sent staff to the current training program? If so, what was their response? Do you plan to send your Internal Auditor(s) to the Council’s training? Either leave a comment or E-mail me at wconway@403labs.com.
-Marc
March 2nd, 2010 at 9:15 pm
This not only undermines PCI but just undermines the benefit of a 3rd party. On a cost basis, it’s probably a no-brainer. Realistically, if you want PCI to work, you can’t have the person managing the books and writing the checks. They’re going to do what’s in the best interest of the bottom line.
Just look at things as simple as using CVV for online transactions. It’s in the best interest of every for fraud prevention. It’s free and easy to use. Most big retailers don’t use it because the losses incurred when requiring cvv outweigh their losses from fraud.
March 4th, 2010 at 3:53 pm
I think this arrangement represents a balanced compromise. The goal was to increase the overall quality of merchant assessments, specifially self-assessments. Originally that was to be accomplished by expanding the QSA franchise. This solution allows merchants to continue self assessing, while mandating a measurable and demonstrable understanding of PCI DSS by the self-assessor through examination. It also keeps the QSA firms sharp by forcing them to deliver value above and beyond the internal assessor to EARN merchant business, as opposed to having it handed to them.