WAKEFIELD, MA - The Payment Card Industry Security Standards Council (PCI SSC) published a new supplement last week addressing cloud service security, SC Magazine reports.

The document, PCI DSS Cloud Computing Guidelines Information Supplement, helps merchants select cloud service providers (CSPs) and implement best practices to safeguard data while doing business in the cloud. It defines common service models for cloud computing environments, the role of third-party CSPs, and the security challenges faced by those organizations.

"You are on a server with 50 or 100 other customers, and [CSPs] sometimes put in the contract that they don't want merchants going through this information, because you might be getting into others people's data or territory," said Russo, general manager of the PCI SSC in explaining how retailers are often hampered by access restrictions that third-party CSPs place on data stored in the cloud. "But if you are a merchant, you are ultimately responsible for your client's card data."

The liability is more pronounced, Russo said, as many CSPs outsource data to other providers. "All of a sudden, your cardholders' data is not only hosted by your CSP, but by their third-party clients," he said. "Understand where in the cloud your payment card data is, then understand who has the responsibility to protect that ?" and that this is in your contract."

The new guidance clarifies for auditors and merchants each party??s duties along with best practices to protect customer data.

As a general rule, merchants should encrypt the sensitive card data they place in the cloud and ensure only the right people have access to it, said Chris Brenton, director of security at Cloud Passage, a San Francisco-based CSP.