About PCI DSS, ISO 27001 and EI3PA Best Practices and Components for Continual Compliance within IT Standards/Regulations Challenges in the Continual Compliance Space

1. Continual Compliance – PCI DSS, ISO 27001
and EI3PA
By Kishor Vaswani, CEO - ControlCase

2. Agenda
• About PCI DSS, ISO 27001 and EI3PA
• Best Practices and Components for Continual
Compliance within IT Standards/Regulations
• Challenges in the Continual Compliance Space
• Q&A
1

3. About PCI DSS, ISO 27001 and EI3PA

4. What is PCI DSS?
Payment Card Industry Data Security Standard:
• Guidelines for securely processing, storing, or
transmitting payment card account data
• Established by leading payment card issuers
• Maintained by the PCI Security Standards Council
(PCI SSC)
2

5. PCI DSS Requirements
Control Objectives Requirements
Build and maintain a secure network 1. Install and maintain a firewall configuration to protect
cardholder data
2. Do not use vendor-supplied defaults for system passwords and
other security parameters
Protect cardholder data 3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across open, public
networks
Maintain a vulnerability
management program
5. Use and regularly update anti-virus software on all systems
commonly affected by malware
6. Develop and maintain secure systems and applications
Implement strong access control
measures
7. Restrict access to cardholder data by business need-to-know
8. Assign a unique ID to each person with computer access
9. Restrict physical access to cardholder data
Regularly monitor and test networks 10. Track and monitor all access to network resources and
cardholder data
11. Regularly test security systems and processes
Maintain an information security
policy
12. Maintain a policy that addresses information security
3

6. What is EI3PA?
Experian Security Audit Requirements:
• Experian is one of the three major consumer
credit bureaus in the United States
• Guidelines for securely processing, storing, or
transmitting Experian Provided Data
• Established by Experian to protect consumer
data/credit history data provided by them
4

7. EI3PA Requirements
Control Objectives Requirements
Build and maintain a secure
network
1. Install and maintain a firewall configuration to protect
Experian provided data
2. Do not use vendor-supplied defaults for system passwords and
other security parameters
Protect Experian data 3. Protect stored Experian provided data
4. Encrypt transmission of Experian data across open, public
networks
Antivirus 5. Use and regularly update anti-virus software on all systems
housing, accessing or processing Experian provided data.
Implement strong access control
measures (Logical and Physical)
6. Restrict access to Experian provided data by business need-to-
know
7. Restrict physical access to Experian provided data
8. Assign a unique ID to each person with computer access to
systems housing or processing Experian provided data.
Regularly monitor and test
networks
9. Track and monitor all access to network resources that Experian
provided data is transmitted across.
10. Develop and maintain secure systems.
11. Regularly test security systems and processes that pertain to
Experian provided data.
Maintain an information security
policy
12. Maintain a policy that addresses information security for
employees and contractors.
5

8. What is ISO 27001/ISO 27002
ISO Standard:
• ISO 27001 is the management framework for
implementing information security within an
organization
• ISO 27002 are the detailed controls from an
implementation perspective
6

9. ISO 27002 Controls
Control Objectives Sub-Requirements
Security Policy Information Security Policy
Organization of information security Internal organization, External parties
Asset Management Responsibility for assets, Information classification
Human Resources Security Prior to employment, During employment, Termination or change of
employment
Physical and environmental security Secure areas, Equipment security
Communications and operations management Operational procedures and responsibilities, Third party service delivery
management, System planning and acceptance, Malicious and mobile
code, Back-up, Network security management, Media handling,
Exchange of information, Electronic commerce services, Monitoring
Access Control User access management, User responsibilities, Network access control,
Operating system access control, Application and information access
control, Mobile computing and teleworking
Information Systems Acquisition, Development
and Maintenance
Technical vulnerability management, Security requirements of
information systems, Correct processing in applications, Cryptographic
controls, Security of system files, Secure development
Information Security Incident Management Reporting of incidents, Management of incidents
Business Continuity Management Information security aspects of business continuity
Compliance Compliance with legal requirements, Compliance with security policies
and standards, Information systems audit consideration
7

10. Best Practices and Components for Continual
Compliance within IT Standards/Regulations

11. Components of Continuous Monitoring
• Unified Compliance Management
• Policy Management
• Vendor/Third Party Management
• Asset and Vulnerability Management
• Change Management and Monitoring
• Incident and Problem Management
• Data Management
• Risk Management
• Business continuity Management
• HR Management
• Compliance Project Management
8

12. Unified Compliance Management
9
ISO 27001
PCI DSSEI3PA

13. Unified Compliance Management
10
 Test once, comply to multiple regulations
 Mapping of controls
 Automated data collection
 Self assessment data collection
 Executive dashboards

14. Policy Management
11
 Appropriate update of policies and procedures
 Link/Mapping to controls and standards
 Communication, training and attestation
 Monitoring of compliance to corporate policies
Reg/Standard Coverage area
ISO 27001 A.5
PCI 12
EI3PA 12

15. Vendor/Third Party Management
12
 Management of third parties/vendors
 Self attestation by third parties/vendors
 Remediation tracking
Reg/Standard Coverage area
ISO 27001 A.6, A.10
PCI 12
EI3PA 12

16. Asset and Vulnerability Management
13
 Asset list
 Management of vulnerabilities and dispositions
 Training to development and support staff
 Management reporting if unmitigated vulnerability
 Linkage to non compliance
Reg/Standard Coverage area
ISO 27001 A.7, A.12
PCI 6, 11
EI3PA 10, 11

17. Change Management and Monitoring
14
Escalation to incident for unexpected logs/alerts
Response/Resolution process for expected logs/alerts
Correlation of logs/alerts to change requests
Change Management ticketing System
Logging and Monitoring (SIEM/FIM etc.)
Reg/Standard Coverage
area
ISO 27001 A.10
PCI 1, 6, 10
EI3PA 1, 9, 10

18. Incident and Problem Management
15
 Monitoring
 Detection
 Reporting
 Responding
 Approving
Lost Laptop
Changes to
firewall
rulesets
Upgrades to
applications
Intrusion
Alerting
Reg/Standard Coverage area
ISO 27001 A.13
PCI 12
EI3PA 12

19. Data Management
16
 Identification of data
 Classification of data
 Protection of data
 Monitoring of data
Reg/Standard Coverage area
ISO 27001 A.7
PCI 3, 4
EI3PA 3, 4

20. Risk Management
17
 Input of key criterion
 Numeric algorithms to compute risk
 Output of risk dashboards
Reg/Standard Coverage area
ISO 27001 A.6
PCI 12
EI3PA 12

21. Business Continuity Management
18
 Business Continuity Planning
 Disaster Recovery
 BCP/DR Testing
 Remote Site/Hot Site
Reg/Standard Coverage area
ISO 27001 A.14
PCI Not Applicable
EI3PA Not applicable

22. HR Management
19
 Training
 Background Screening
 Reference Checks
Reg/Standard Coverage area
ISO 27001 A.8
PCI 12
EI3PA 12

23. Compliance Project Management
20
Your Project Manager is charged with your Success:
1. Serves as your single point of contact and your advocate
for all compliance activities
2. Ensures all compliance requirements are met on schedule.
• Builds a single stream, reliable communication channel
• Strategizes to produce an efficient plan based on your
needs
• Periodic pulse checks via status reports &meetings
paced according to your stage and schedule
3. Prepares you for smooth and predictable activities across
multiple compliance paths

24. Challenges in Continual Compliance
Space

25. Challenges
• Redundant Efforts
• Cost inefficiencies
• Lack of compliance dashboard
• Fixing of dispositions
• Change in environment
• Reliance on third parties
• Increased regulations
• Reducing budgets (Do more with less)
21

26. ControlCase Solution

27. Learn more about continual compliance ….
22
Compliance
as a Service
(Caas)

28. Why Choose ControlCase?
• Global Reach
› Serving more than 400 clients in 40 countries and rapidly
growing
• Certified Resources
› PCI DSS Qualified Security Assessor (QSA)
› QSA for Point-to-Point Encryption (QSA P2PE)
› Certified ASV vendor
› Certified ISO 27001 Assessment Department
› EI3PA Assessor
23

29. To Learn More About PCI Compliance or Data Discovery…
• Visit www.ControlCase.com
• Call +1.703.483.6383 (US)
• Call +91.9820293399 (India)
• Kishor Vaswani (CEO) – kvaswani@controlcase.com
24

30. Thank You for Your Time