PCI Compliant Security Policy
The most important item in documenting PCI-DSS compliance is the comprehensive PCI Security Policy. Documentation is one of the main steps in becoming PCI compliant and the Security Policy is not something to be taken lightly. It will help to have a professional technical writer who has worked on PCI-DSS compliance projects to put the Security Policy together. The PCI Guy is a PCI-DSS consulting and documentation firm that specializes in these types of documents.
Other People Are Reading
-
Interviewing Subject Matter Experts
-
Your writer will need to talk to those responsible for various areas of PCI-DSS compliance. Different companies will have resources grouped into different areas, but in general, subject matter experts (SMEs) will come from the departments of IT, development, business and human resources.
Documenting Information from Subject Matter Experts
-
After interviewing the various SMEs, your writer will then begin documenting the information he has been given. Including PCI-DSS citations along the way in the document will help ensure that all of the requirements are covered (a PCI-DSS requirement itself).
-
Vetting Information from Subject Matter Experts
-
After writing the policy and making sure that all PCI-DSS requirements are covered, your writer will go back to the SMEs and make sure that all of the information is accurate and reliable. Make sure that the SMEs are responsible for the information contained within the Security Policy. The writer is there to make suggestions as to how the information will be presented, but he should not be held responsible for erroneous information, such as firewall configurations and access control methods.
Vetting the Security Policy with the Qualified Service Assessor (QSA)
-
This is perhaps the most important step. Before your QSA comes onsite to conduct the PCI-DSS assessment, submit your security policy to him and make sure that it is approved. The last thing you want to have happen is to have a QSA certify your systems, processes and procedures as being compliant, but note that a problem exists with your documentation (specifically, your Security Policy) that will cause a delay in your becoming PCI-DSS compliant.
Distributing the Security Policy
-
After the Security Policy is written and approved, distribute it to those resources that have been deemed "in-scope" for PCI-DSS. This not only ensures that everyone knows what is expected and required, but also it is a requirement of PCI-DSS itself.
-
