Network Security Blog

This is an interesting development in PCI compliance: a group of vendors have grouped together to create the PCI Security Vendor Alliance.  I see a mission statement and a lot of interestingly vague statements, but what I don’t see anywhere is a statement affiliating the PCI SVA with Visa or Master Card directly.  Even the relationship with the PCI Standards council could be clearer. 

How does the PCI Security Vendor Alliance relate to the PCI Standards Council?
The PCI SVA is a member of the PCI Standards Council, and fully supports the mission of the Council. The PCI Standards Council is responsible for developing and managing the PCI Data Security Standard, including maintenance, clarification and revisions of the Standard. The Council has established approval processes for two categories of vendors: (1) qualified security assessors and (2) network scanning vendors. In contrast, the PCI SVA deals with all other categories of product and services vendors - those that are NOT covered by the charter of the PCI Standards Council. Unlike the council, the PCI SVA does NOT certify the PCI DSS compliance of any product or vendor. Instead, the members of the PCI SVA are typically brought in by a merchant or financial institution after a PCI DSS assessment, in order to help the organization achieve compliance with PCI DSS.

I fixed the link in the quote, it’s HTTPS not HTTP as it was on the PCI SVA site; I’m sure they’ll fix it soon.  I have a talk with Protegrity, a member of PCI SVA scheduled for RSA, I’ll ask more about it then.

Technorati Tags: security, mckeay, PCI, PCI SVA

Trackback URI | Comments RSS