When an organization is starting off on its PCI journey,
completing all of the 280 or so requirements is really scary.
So the PSI SSC produced a document called the Prioritized Approach,
which divides over 280 PSI DSS requirements into six separate milestones.
The idea being that the requirements included in the first
milestone would have the largest effect in reducing the
probability of a successful criminal attack.
The idea was to encourage merchants to do the things that
gave them the most benefit first and the things that gave
them the least benefit last.
So it steadily reduces risk while an organization becomes more compliant.
The first milestone, Milestone 1,
includes requirements to get rid of data that the organization doesn't need,
pretty straightforward there.
Milestone 2 contains requirements to protect systems and networks
and these are mostly found in PSI DSS requirements one and two
and also to respond to an incident.
So that's 12.
10, I think, off the top of my head.
The third Milestone looks at things like patching
and secure software development.
So all payment card accepting applications are secure.
Milestone 4 is all about controlling access and monitoring access.
So that includes many of the items in requirements seven,
eight, and ten of the standard.
Milestone 5 is about protecting stored cardholder data and
all the encryption requirements are here.
I've been asked on lots of occasions, why encryption is in such a low milestone,
why is it fifth priority?
The fact is that most organizations find encryption really hard to do,
so on many occasions where criminals steal encrypted data,
they also steal the keys at the same time.
So doing encryption well is hard, doing encryption badly is easy.
You get a much greater risk reduction by deleting data you don't need,
securing the perimeter, and securing systems.
The final milestone includes all the remaining PSI DSS
requirements with all that documentation of policies and
processes listed in requirement 12.
The Prioritized Approach is really well described in
the document on the PSI SSC website.
You can see here a page taken from it that shows the separate
requirements in requirement one split between milestone one and
milestone two and milestone six.
The document, like all PSI SSC documents,
is freely available from the PSI Security Standards Council website.
Now,
although the PSI SSC created the Prioritized Approach as a way of
helping organizations to focus their PCI journey on just the
requirements that provide the most security,
something strange happened.
The card brands,
they decided to use that as part of their card brand compliance programs.
And so for organizations that are not yet compliant,
they'll often be asked by their acquirer to say which
of the milestones they've completed.
To make that job easy,
they PSI SSC produced a spreadsheet listing all the
requirements and the milestones that relate to them.
This spreadsheet is known as the Prioritized Approach
Tool or some people call it the PAT.
It's an Excel spreadsheet and you can use it for both tracking your
compliance and also reporting compliance to your acquirer or merchant
bank or even directly to the card brand.
You can download the spreadsheet from the PCI SSC website.
Rather that keep talking about it, let's have a look at how it works.
So you can see here that I'm just finishing entering the
compliance status for requirement 6.
4.
3 which is the one that prohibits using live PANs in
testing or development environments.
I checked that this doesn't happen in my organization we've
defined that you can't do it in the SDLC and so now I've
marked the requirement as in place.
That was the last requirement I had to update.
If I switch over to the summary tab you can see that the spreadsheet
calculates how much of each milestone has been completed.
It's a pretty simple calculation,
it just adds them up and works out a percentage.
But it's really helpful to track your progress to
compliance while your reducing risk.
It's a great statistic to report to management.
Because one of the problems with PSI DSS compliance
is you start off non-compliant, you spend a year or two getting compliant,
then you're compliant.
And your boss keeps saying, how we doing?
And you say well we're still not compliant, oh now we're compliant.
So having the prioritized approach to it and be able to say we'll we've hit
100% of milestone one now and we've done 50% of milestone two,
that can show onward progress.
So the aim is to do the first milestone as 100% complete because that reduces
the risk and it improves the security of payment card data.
Many acquirers actually ask merchants that are not yet compliant to
report these figures every three or every five months.
The Prioritized Approach Tool gets a lot of use in the typical
compliance lifecycle for an organization.
You spend a number of years getting compliant and during this time you
monitor and track your progress using the prioritized approach.
You'll often have to provide half-yearly updates with the milestone
percentages from the tool to your acquiring bank or card scheme.
Eventually you work out that you're ready for your first PSI DSS assessment
whether that's an external assessment or a self assessment,
the assessment happens and hopefully the end result is a Report on
Compliance or a Self Assessment Questionnaire.
Now you can sit back and relax.
Well, for a day anyway.
Because you'll have to maintain continuous compliance for the
standard every single day which means that the end of any PCI
program must be a transition into business as usual to ensure that
continuous compliance is maintained.
Then, 12 months after your first formal PSI DSS assessment,
it's time to do it all again.
Because all card scheme compliance programs require you to provide
evidence of your compliance by annual reassessments.