PCI DSS Implementation and Continual Improvement

PCI DSS Implementation and Continual Improvement

Following a gap analysis, IT Governance can assist you with a PCI implementation project that will help your organisation achieve and maintain compliance with the Standard. Achieving PCI compliance is a point-in-time event, but adhering to the PCI DSS and maintaining PCI compliance is an ongoing process that should be part of a ‘business-as-usual’ approach, according to the PCI Security Standards Council.

Your challenge

PCI DSS remediation is an essential phase for organisations wishing to comply with the Standard. While implementing these changes can be costly both in time and resources, an expert-driven remediation plan can significantly streamline compliance efforts. With this service you can:

• Establish a clear and concise plan to reach full compliance
  
• Demonstrate a greater return on investment (ROI) through efficient use of budget and resources
  
• Confidently indicate when you will be PCI-compliant
  
• Present a business case for executive sponsorship and funding

Our service offering 

• An analysis to reduce the in-scope component of the network and application infrastructure, reducing the PCI compliance burden.
  
• Guidance to identify, implement and maintain the appropriate processes and procedures that will help you achieve your compliance goals.
  
• Support creating the documentation required for compliance (i.e. policies and procedures).
  
• An analysis of your own and your service providers’ responsibilities.
  
• Regular checkpoint meetings to ensure that the project remains focused and on track.
  
• Implementation of PCI staff awareness training.
  
• Help designing and implementing an internal PCI DSS project team to undertake the remediation work.
  
• Counselling and support to facilitate an ongoing PCI compliance programme.
  
• Guidance and advice whenever a change has been made to your systems and/or networks.
  
• Ongoing assessment, remediation and maintenance activities.
  
• Internal and external penetration testing services.
  
• Transitioning to new versions of the Standard.
  
• Preparation for the annual PCI audit.