This is page 2 of:
PCI Mobile Madness: Council Clarifications Not Helping
There’s also the bigger issue that retailers are moving ahead with mobile functionality now, and many won’t risk waiting much longer. Do they risk future PCI compliance by not stalling their mobile deployment efforts?
As we’ve noted, acquirers always have had the power to clean some of this up by moving in and approving mobile-payment applications directly. Then again, that invites the kind of confusion and industry-wide inconsistencies that PCI was created to eliminate.
PCI has said little to clarify many of these issues. On January 25, the Council offered an addendum. However, the only new datapoint it offered is that the Council is looking at not merely mobile apps but the hardware surrounding those apps. It seemed an odd clarification, as it’s unlikely anyone in the retail or payment community thought otherwise.
When asked about whether existing mobile apps would likely be delisted, the Council merely restated long-standing policy that any apps could be delisted “should the Council determine they do not meet the intent of PA-DSS requirements.” Taken literally, that would seem to suggest that no applications would be delisted until the mobile review process is complete, because the Council couldn’t determine the intent of its requirements until it had created those mobile requirements. But the Council makes its rules, and it can change them.
The Council did say hardware is the key, and applications designed to run on hardware that seems to be compliant would have a much easier time. The only problem is that the Council’s mobile teams are also evaluating hardware criteria, so it’s impossible to know which devices will still be approved when its review is done.
“At this time, the Council can confidently sanction payment applications (assuming they meet all of the existing PA-DSS requirements) that are designed for use on PTS approved mobile devices as these platforms include third-party validated physical and logical security functions that are designed to protect cardholder data,” said a PCI Council response to an E-mail question. “All other mobile communication devices need to be assessed to determine security risk they represent.”
In short, the PCI mobile world is full of questions and risks, with almost no comforting assurances from anyone. The only calming thought: Your competitors are having the identical nightmares. In that sense, PCI has delivered some industry-wide mobile consistency.
-Marc
February 10th, 2011 at 12:16 pm
A ROC and a hard place. Evan, you crack me up!
Emma.
February 10th, 2011 at 12:48 pm
It shouldn’t come as a surprise to anyone that the mobile evolution is causing strain on current standards. It didn’t really exist when the standards were contemplated. Now we’re playing catch up. But the evolution and adoption isn’t going to slow, because PCI isn’t ready for mobile. We might see some Level 1 and 2 merchants delay programs until PCI sorts out their thoughts. Others will run the risk hoping for a competitive advantage. That should make for interesting conversation with their QSA, if they choose to disclose it.
The Level 4 merchants don’t know this debate is happening. Mobile apps are start popping up all over as small entrepreneurs look for a competitive edge. That trend will only increase. PCI could petition the app platform companies to disallow payment applications from being available for download to consumer devices, but that seems like a stretch.
The longer PCI takes to get its position in place, the higher the likelihood that the requirements get ignored or marginalized.
February 10th, 2011 at 3:30 pm
If I’m not mistaken, I believe the PCI SSC has already addressed approved applications being delisted in its statement from January 25, 2011: “Until it has completed a comprehensive examination of the mobile communications device and mobile payment application landscape, the Council will not approve *or list* (my emphasis) mobile payment applications used by merchants to accept and process payment for goods and services as validated PA-DSS applications unless all PA-DSS requirements can be satisfied as stated and the underlying mobile communications device supports the merchant’s PCI DSS compliance.”
It appears this statement indicates that it is only a matter of time until the approved applications are delisted.
February 10th, 2011 at 3:52 pm
We saw that, too, but it’s still subject to interpretation.