Getting Started with Your PCI DSS Charter

Well over a year ago, the PCI Standards Council announced, in addition to other requirements, that a PCI charter would now be required for service providers after January 31, 2018.  Few service providers have implemented this yet, but all will soon need one to maintain or achieve PCI compliance.

Many ask what a PCI charter needs to include.  Unless you have undergone ISO 27001 certification, a charter may be new term for security officers, let alone a PCI charter.  The PCI DSS does not contain much in the way of guidance, and that alone contributes to the general state of hesitation to start on the charter. 

Simply put, a charter is a formal assignment of authority and responsibility.  In line with the PCI DSS, a PCI charter must include the following key elements:

1. In the PCI charter, assign the overall responsibility for the organization to maintain PCI DSS compliance to executive management, for accountability.

This may include individual roles as well as business unit roles within the organization.  This assignment "ensures executive-level visibility into the PCI DSS compliance program and allows for the opportunity to ask appropriate questions to determine the effectiveness of the program and influence strategic priorities."

Executive management may include C-level positions, board of directors, or equivalent.  The specific titles will depend on the particular organizational structure.  Assigning executive management the authority and responsibility for maintaining PCI compliance establishes executive management’s connection to the PCI compliance program.

2. The level of detail provided to executive management on their assigned responsibility(ies) should be appropriate for the particular organization and the intended audience.

This is an area that will take some level of organization and creativity, and probably the most level of effort for the charter.  What will the particular assigned responsibilities be?  Should periodic activities be defined and outlined?  Should multiple members of executive management be assigned responsibilities?  How will their responsibilities vary and/or overlap?  The answer to these questions should arise out of discussions about the charter with stakeholders. 

For obvious reasons, executive management should be involved in the design and assignment of responsibilities outlined in the charter.  Do not wait until the last minute to involve executive management in preparing the PCI charter.  The PCI DSS does not specify what the responsibilities of executive management must be EXCEPT that overall responsibility for the organization to maintain PCI DSS compliance is assigned to executive management.

3. Have executive management sign the charter. The charter should be signed by the person(s) in executive management assigned overall responsibility for the organization to maintain PCI compliance.  Signing the charter shows that executive management has not only read the charter but also has accepted the responsibility(ies) outlined in the charter.  It also shows that the charter has been communicated to executive management.