This is page 3 of:
The PCI SAQ Problem: Versions Are Much Too Incomplete
The Council should include physical inspection and monitoring of POS devices in PCI. It would fit reasonably well in either Requirement 9 (physical access) or Requirement 10 (monitoring and testing). In the meantime, checking POS devices is good security, and it should be part of every merchant’s compliance plan.
SAQs C and C-VT can apply to merchants who use the Internet to process transactions. In next week’s column, I’ll suggest PCI requirements beyond what are already in those SAQs.
Keep in mind that all of this is one QSA’s experience and opinion. Merchants should look at their particular situation, network and infrastructure. As the saying goes, “Your mileage may vary.”
Should the PCI Council revise the SAQs to reflect some of these additional requirements? I’ll leave that decision to the Council and the card brands. The simplified SAQs are collectively a great innovation, and they have helped make PCI compliance more approachable for many small and midsize businesses. By offering an incentive (easy validation), the Council also caused many merchants to stop storing electronic cardholder data. This result alone greatly reduces the chance of a data breach.
My only regret is that the SAQs are not positioned as guidance or a compliance starting point. Instead, some merchants interpret them as the limit of their PCI compliance effort. Validation is not the same as compliance. At one level, validation is once a year and compliance is what merchants do every day. At another level—and that is what this column is about—validation with a shortened SAQ may look good on paper, but compliance has always meant complying with all of PCI DSS.
Just because the Council may not include some PCI requirements in a particular SAQ does not mean merchants have a free pass on PCI. If a merchant suffers a data breach, I would not plan on the “But that requirement wasn’t in my SAQ” defense being very effective. Next week, we’ll look at the remaining SAQs.
What do you think? Do you use a shortened SAQ? Does your company look beyond the SAQ or is that all you do for PCI compliance? I’d like to hear your thoughts. Either leave a comment or E-mail me at wconway@403labs.com.
Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code.
-Marc
