Guest Columnist David Taylor is the Founder of the PCI Knowledge Base, Research Director of the PCI Alliance and a former E-Commerce and Security analyst with Gartner.At this week's National Retail Federation CIO conclave, NRFtech, the CIO of J.C. Penney presented the keynote, which focused on the top five priorities for the business and the technical implications of these priorities. PCI compliance, perhaps not surprisingly, was one of these top five priorities.
During the discussion, the CIO, Thomas Nealon, commented that one of the biggest challenges when it comes to PCI is explaining to businesspeople why it's a priority. This is a common refrain among merchants of all types and sizes. Because there are a lot of examples of this in the Knowledge Base
, I thought we could discuss some of them, so that others may be able to use them in their own companies.Yell "SECURITY BREACH" really loudly, all the time. A somewhat less extreme version of this is actually pretty common among merchants. Although it can be effective in some cases, it works best as a motivator of businesspeople if you can cite specific statistics and/or industry peers who have been breached. For the statistics themselves, check out http://datalossdb.org/, which is hosted by the Open Security Foundation.
However, like crying "Wolf," or talking about the end of the world, this only works for a short period of time. In addition, the use of this tactic can backfire if someone decides to cite the latest financial results from TJX as "proof" that security breaches have no discernable negative impact on revenues. So, although fear of a security breach can get business people to come to a meeting, you'll need a "second act" to keep them in their seats.
Relate PCI to customer care. Businesspeople recognize that customer data is an asset of the business. But they assume that it's already being protected. After all, they've been "paying the freight" for the IT organization for years, and they assume that part of that money goes to customer data security. So the task is getting them to see that more security is needed, without making the CISO look incompetent. The best retailers we've talked to address this by demonstrating the pervasiveness of customer data—specifically credit card data—and pointing out that the more data the merchant has, the more it will cost to protect that data.
Another tactic we've seen used effectively is to talk about the marketing value of being a PCI leader. Although PCI compliance doesn't make for exciting TV advertisements, making sure customer service representatives—as well as sales and marketing—can explain to customers how their data is secured is a handy message to help get businesspeople to connect PCI with customers.
Show threatening letters from the merchant bank. In most cases, the dollar cost of the fines levied by the card brands, through the acquiring banks, is not sufficient to excite businesspeople. But the thread of interchange fee "downgrades" can cost a merchant millions of dollars per year. Obviously, the CFO does not enjoy receiving letters threatening fines or downgrades. This makes the CFO a major ally in getting business units to pay attention. Sometimes this happens in a meeting among the CEO, CFO, CIO and the business unit heads, and other times it's much more subtle, like when PCI becomes a "priority project" of the CFO rather than the CIO.
But it's still necessary to get line management to care, because they have to make changes to business processes, re-train staff, etc. Working with Internal Audit can facilitate this process, because they usually report to the CFO. Some of the best "perpetual PCI" solutions we've seen involve Internal Audit, working with IT security for added technology cross-training, serving as the "big stick" to get business departments and store management to make PCI a top priority.
Hand PCI to the Project Management Office (PMO). In some cases, it's not Internal Audit or IT or even Information Security that drives the PCI bus; rather, it's the corporate PMO. Because the PMO often reports to the CEO, CFO or COO, the office can be a major mover and shaker for PCI. But getting PCI on PMO agendas isn't easy; the office often has an Operations focus rather than an IT focus.
Selling PCI to the PMO is typically done by the CFO or COO as a delegation, but it can also be handled via a subtle handoff of a "high visibility, high reward" program. The PMO is a good organization to work with in the early stages of PCI compliance, but the job needs to be shifted elsewhere (Internal Audit or Information Security or Business Operations) after that.
Hire a security geek with a sales background. This just illustrates how difficult it is to try to run PCI solely out of IT or IT security. There are just too many changes needed to how the company does business for an IT person who has never visited stores and who typically knows one specific area of technology very well (and others not-so-much).
Technologists are often at a loss when it comes to convincing businesspeople to change how they run the organization. This is not to say it cannot be done, but it's much better if the IT organization can enlist the aid of the PMO and/or Internal Audit to work with the business people on addressing the operational implications of PCI.
The ROI of PCI. One final thing: We've talked to some organizations where fraud reduction is a key business driver of PCI. Essentially, they have developed models that connect specific PCI-mandated controls (not all of PCI) with a reduction in credit card fraud. The implication is that these merchants can "prove" that "PCI Saves Money," which is not a phrase one hears very much but is still very helpful in convincing businesspeople to support PCI compliance efforts. But most merchants are not in a position to connect PCI compliance to a reduction in fraud. We are still working on this research and would like to discuss this issue with any reader who has experiences in making this connection.
By the way, if you're a retailer, we want to get you involved in the best practices study we're doing for the National Retail Federation. If you'd like to participate, send me an E-mail at [email protected]