NEW YORK – On January 1, version 3.0 of the PCI (Payment Card Industry) Data Security Standards replaced version 2.0 as the standard. In other words, what some merchants (and financial institutions) already saw as an onerous process is getting harder. This week, Forbes featured an article by Jeremy Lacy, a Qualified Security Assessor and senior consultant at SungardAS. In his article, Lacy provided an overview of the new PCI standards and why they’re a good thing for businesses.

According to Lacey, PCI 3.0 is an attempt to keep pace with the changing world of credit card payment security and to keep the standards relevant to current challenges and opportunities. It’s also a response to events that have taken place since the last DSS version, like the numerous security breaches and mass credit card data thefts that have hit major retailers and financial institutions.
The 96 new standards in PCI 3.0 are about continuing to improve credit card security by maturing the standards that govern how organizations must process, store, and transfer credit card data. Essentially, it gives organizations an updated, more detailed set of standards for protecting themselves and their customers.

So, are you prepared for the more stringent PCI 3.0? According to Lacy, the key is to think holistically and develop a long-term plan for how you can improve security, manage risk wisely and help maintain payment cards as a safe and secure means for conducting payment transactions. He suggests that PCI offers key principles for making a true commitment to becoming and staying secure:

• Combine security goals with other key business goals.
• Articulate security goals using the same terms as other business goals.
• Assign responsibility for ensuring the achievement of security goals and hold accountable those with responsibility.
• Develop tools, techniques, and metrics for tracking the performance and sustainability of security activities.
• Evolve security goals and practices as other business goals and risks evolve.