Should Retailers Use PCI Training To Enhance—Or Replace—Their QSA?
Written by Walter ConwayMarch 2nd, 2010
Details of the PCI Council’s new “Merchant QSA” training program will be finalized in a few months, but it's unclear how retailers will use it. PCI Columnist Walt Conway asks, is a few days’ training enough to qualify your Internal Auditor to lead a PCI compliance assessment?
What is the business case for using an Internal Audit instead of a QSA? Could the training—whether for a Level 1 or a Level 2 merchant—be used to build on or supplement a QSA? That is, will the Merchant QSA training be most useful to merchants as a valuable accessory rather than an entirely new PCI wardrobe?
This Story Is Only Available For Premium Subscribers. Click Or Login In Below To Read The Rest Of This Story.
Already a Subscriber? Login Here
Pages: 1 2
2 Comments | Read Should Retailers Use PCI Training To Enhance—Or Replace—Their QSA?
Leave a Reply
Readers, specifically those who want to comment on a story:
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
Our Comment SPAM system is getting very aggressive these days and has been blocking legitimate comments. If you post a comment and don't see it appear within 2 hours or so, can you please send a heads-up to customer-service@storefrontbacktalk.com? Ideally, please include the time you posted the comment. That will allow us to try and hunt for it. Thanks! P.S. We're working on fixing the system, but we don't want to lose any valuable comments in the meantime.
-Christine
March 2nd, 2010 at 9:15 pm
This not only undermines PCI but just undermines the benefit of a 3rd party. On a cost basis, it’s probably a no-brainer. Realistically, if you want PCI to work, you can’t have the person managing the books and writing the checks. They’re going to do what’s in the best interest of the bottom line.
Just look at things as simple as using CVV for online transactions. It’s in the best interest of every for fraud prevention. It’s free and easy to use. Most big retailers don’t use it because the losses incurred when requiring cvv outweigh their losses from fraud.
March 4th, 2010 at 3:53 pm
I think this arrangement represents a balanced compromise. The goal was to increase the overall quality of merchant assessments, specifially self-assessments. Originally that was to be accomplished by expanding the QSA franchise. This solution allows merchants to continue self assessing, while mandating a measurable and demonstrable understanding of PCI DSS by the self-assessor through examination. It also keeps the QSA firms sharp by forcing them to deliver value above and beyond the internal assessor to EARN merchant business, as opposed to having it handed to them.