WAKEFIELD, Mass., February 07, 2013 — Today the PCI Security Standards Council (PCI SSC), an open, global forum for the development of payment card security standards published the PCI DSS Cloud Computing Guidelines Information Supplement, a product of the Cloud Special Interest Group (SIG). Businesses deploying cloud technology can use this resource as a guide for choosing solutions and third-party cloud providers that will help them secure their customer payment data and support PCI DSS compliance.
PCI Participating Organizations selected cloud computing as a key area to address via the SIG process. More than 100 global organizations representing banks, merchants, security assessors and technology vendors collaborated on this guidance designed to help companies identify and address the security challenges for different cloud architectures and models, and understand their PCI DSS responsibilities when implementing these solutions.
Cloud Overview – provides explanation of common deployment and service models for cloud environments, including how implementations may vary within the different types.
Cloud Provider/Cloud Customer Relationships– outlines different roles and responsibilities across the different cloud models and guidance on how to determine and document these responsibilities.
PCI DSS Considerations – provides guidance and examples to help determine responsibilities for individual PCI DSS requirements, and includes segmentation and scoping considerations.
PCI DSS Compliance Challenges- describes some of the challenges associated with validating PCI DSS compliance in a cloud environment.
Additional Security Considerations – explores a number of business and technical security considerations for the use of cloud technologies.
The document also includes a number of appendices to address specific PCI DSS requirements and implementation scenarios, including: additional considerations to help determine PCI DSS responsibilities across different cloud service models; sample system inventory for cloud computing environments; sample matrix for documenting how PCI DSS responsibilities are assigned between cloud provider and client; and a starting set of questions that can help in determining how PCI DSS requirements can be met in a particular cloud environment.
The information supplement can be downloaded from the documents library on the PCI SSC website athttps://www.pcisecuritystandards.org/security_standards/documents.php. Download cloud computing guidelines document here.
Merchants who use or are considering use of cloud technologies in their cardholder data environment and any third-party service providers that provide cloud services or cloud products for merchants can benefit from this guidance. This document may also be of value for assessors reviewing cloud environments as part of a PCI DSS assessment.
This entry was posted in PCI Compliance and tagged cloud payments, pci dss, pci Security Standards by Christine Speedy. Bookmark the permalink.
Christine Speedy, blog author, is an authorized sales agent for CenPOS, a SaaS, private cloud payment processing suite of solutions that creates numerous efficiencies for merchants, and reduces the burden for PCI Compliance. Per the new PCI DSS Cloud Computing guidelines, CenPOS as a Cloud Service Provider, or CSP, fits the model for the maximum reduction in merchant scope.