<img height="1" width="1" style="display:none" src="https://www.facebook.com/tr?id=1977396509252409&amp;ev=PageView&amp;noscript=1">

LIVE WEBINAR: SOC for Software - How SOC for Supply Chain Reduces Software Risk | July 29th

Contact a Specialist
Industry Solutions
Industry Solutions
Cloud Computing & Data Centers
Cloud Computing & Data Centers
Financial Services & Fintech
Financial Services & Fintech
Healthcare
Healthcare
Payment Card Processing
Payment Card Processing
US Government
US Government
Learning Center
Learning Center
Articles
Articles
Whitepapers
Whitepapers
Case Studies
Case Studies
Events & Live Webinars
Events & Live Webinars
On-Demand Webinars
On-Demand Webinars
Compliance Reliance
Compliance Reliance
About Us
About Us
Leadership Team
Leadership Team
Careers
Careers
Corporate Social Responsibility
Corporate Social Responsibility
ERIC SAMPSON

By: ERIC SAMPSON on October 25th, 2017

Print/Save as PDF

Getting started with your PCI DSS Charter

Well over a year ago, the PCI Standards Council announced, in addition to other requirements, that a PCI charter would now be required for service providers after January 31, 2018.  Few service providers have implemented this yet, but all will soon need one to maintain or achieve PCI compliance.

Many ask what a PCI charter needs to include.  Unless you have undergone ISO 27001 certification, a charter may be new term for security officers, let alone a PCI charter.  The PCI DSS does not contain much in the way of guidance, and that alone contributes to the general state of hesitation to start on the charter. 

Simply put, a charter is a formal assignment of authority and responsibility.  In line with the PCI DSS, a PCI charter must include the following key elements:

  1. In the PCI charter, assign the overall responsibility for the organization to maintain PCI DSS compliance to executive management, for accountability.

This may include individual roles as well as business unit roles within the organization.  This assignment "ensures executive-level visibility into the PCI DSS compliance program and allows for the opportunity to ask appropriate questions to determine the effectiveness of the program and influence strategic priorities."

Executive management may include C-level positions, board of directors, or equivalent.  The specific titles will depend on the particular organizational structure.  Assigning executive management the authority and responsibility for maintaining PCI compliance establishes executive management’s connection to the PCI compliance program.

  1. The level of detail provided to executive management on their assigned responsibility(ies) should be appropriate for the particular organization and the intended audience.

This is an area that will take some level of organization and creativity, and probably the most level of effort for the charter.  What will the particular assigned responsibilities be?  Should periodic activities be defined and outlined?  Should multiple members of executive management be assigned responsibilities?  How will their responsibilities vary and/or overlap?  The answer to these questions should arise out of discussions about the charter with stakeholders. 

For obvious reasons, executive management should be involved in the design and assignment of responsibilities outlined in the charter.  Do not wait until the last minute to involve executive management in preparing the PCI charter.  The PCI DSS does not specify what the responsibilities of executive management must be EXCEPT that overall responsibility for the organization to maintain PCI DSS compliance is assigned to executive management.

  1. Have executive management sign the charter. The charter should be signed by the person(s) in executive management assigned overall responsibility for the organization to maintain PCI compliance.  Signing the charter shows that executive management has not only read the charter but also has accepted the responsibility(ies) outlined in the charter.  It also shows that the charter has been communicated to executive management.
Having read and understanding the above key elements, organizations can be better equipped to move forward with preparing the PCI charter.  From an auditor perspective, the charter length does not need to be very long.  1-2 pages would be acceptable.  The above points could be used in creating a checklist to verify that the three key elements above are completed prior to submitting the PCI charter for the PCI assessment.

About ERIC SAMPSON

Eric Sampson is a Manager at Schellman. Eric began his professional career in 2005 while working as an IT auditor in Philadelphia. Eric executed several critical projects for clients in the areas of information security and Service Organization Controls (SOC) reporting projects. To date, Eric has provided services to clients in the healthcare, information technology, and financial services industries, among others.