A new report from the Institute of Internal Auditors says compliance with credit-card security standards is still sputtering, despite a coordinated push to bring retailers and merchant banks into compliance with the Payment Card Industry Data Security Standard.


The recent survey of internal auditors, “Moving Toward PCI Compliance,” indicates that only 56 percent of companies are in compliance with PCI DSS, even though the standard was first unveiled in 2004. Nearly 90 percent did say they are trying to implement a PCI compliance process, however.


Survey respondents offered a variety of suggestions to help companies ensure an effective and efficient compliance process. Among the ideas:





  • Train and educate staff about data security breach risks, and how to help achieve compliance.

  • Prohibit storing and tracking credit card information.

  • Avoid unsecured wireless access.

  • Perform an internal audit to determine high-risk areas.

  • Establish network security controls, compartmentalizing the network areas that process credit card information and segregating PCI data from the rest of the network.

  • Establish compensating controls need to be implemented for compliance.

  • Create a steering committee, representing areas that can enhance compliance within the organization.


As part of the survey, the IT Compliance Institute also gave some tips on what internal auditors can do to help ensure PCI compliance:





  • Provide reports to the board and management that state whether key information assets and systems are protected, business units are adhering to policies, programs are in place for continually updating and strengthening safeguards against network assaults, and existing security policies are reasonable.

  • Assess the state of the information control environment and recommend improvements.

  • Compare current organizational practices with industry practices and regulatory guidelines to validate that the organization’s PCI efforts are proactive and effective against current and emerging threats.


Download the full report at www.theIIA.org.