Having attended the annual North American PCI Community Meeting for many years and being involved with PCI compliance since 2008, I’ve heard firsthand the challenges merchants face in their quest for PCI compliance (see Blog: Compliance Headaches Continue). However, thinking back to the PCI Community Meeting last week in Orlando, I was intrigued by how this year’s keynote speaker fit into the program. How could an extreme adventurer, such as Jamie Clarke, rather than a hacker or data breach expert provide the necessary perspective on compliance? As I attended sessions and networked with over a thousand of my peers from 17 countries, it dawned on me: The collective PCI state of mind is reflective of the maturity of the journey and a fresh optimism emerges as we near the top of the mountain after a very long and arduous journey.
Here are some of the highlights from this year’s meeting.
- PCI SSC General Manager Bob Russo presented the annual PCI State of the Industry. The PCI standards continue to mature and merchants are increasing the focus to protect cardholder data. The overall tone was more about ‘tweak’ than change.
- The opportunity for training from the PCI Council continues to increase with several new programs including a Qualified Integrators and Resellers (QIR) program and a Payment Card Industry Professional (PCIP) certification.
- The Special Interest Groups (SIGs) are going strong, which again speaks to the maturity of the standard. We are seeing ongoing clarity, rather than new initiatives. The SIGs leverage valuable business and technical experiences from PCI Participating Organizations (POs). Over 460 POs were in attendance. Our key candidates for the 2013 SIGs are Cardholder Data Discovery and Guidance on Logging. However, there are 7 candidates up for voting.
- Spider Labs presented an overview of mobile device security and reviewed several mobile attack scenarios. The PCI Council has released new guidance on secure mobile payment acceptance.
- Updates to the Council’s Point-to-Point Encryption (P2PE) program are available.
- Feedback on the PCI standards was discussed in preparation for the next releases in 2013.