Comments on: PCI (and compliance) are just tools http://www.mckeay.net/2007/05/29/pci-and-compliance-are-just-tools/ The views of one man on security, privacy and anything else that catches his attention Sun, 20 Jul 2008 14:17:14 +0000 http://wordpress.org/?v=abc By: Michael Dahn http://www.mckeay.net/2007/05/29/pci-and-compliance-are-just-tools/#comment-870 Michael Dahn Wed, 30 May 2007 07:40:51 +0000 http://www.mckeay.net/2007/05/29/pci-and-compliance-are-just-tools/#comment-870 Martin, thanks for covering this. This is an issue that keeps coming up, over and over. Companies struggle to get "compliant", to pass a milestone or meet a timeline, and loose track of the big picture. Recently on the blog commenters have been talking about an ISMS (Information Security Management System), and I agree with you and them that 'security' should be the focus of compliance. In fact, if companies secured the cardholder data in the first place, there would be no need for the compliance program. But, I'd argue even that many times people loose sight of the big picture even when implementing an ISMS or any program for that matter. You can perform risk assessments until you are blue in the face, but good security starts with rational in mind. Rational from the end user all the way up to the person running the program. I agree that security programs are good, but never loose focus on the primary objective - protect the data and the systems holistically. Martin, thanks for covering this. This is an issue that keeps coming up, over and over. Companies struggle to get “compliant”, to pass a milestone or meet a timeline, and loose track of the big picture.

Recently on the blog commenters have been talking about an ISMS (Information Security Management System), and I agree with you and them that ’security’ should be the focus of compliance. In fact, if companies secured the cardholder data in the first place, there would be no need for the compliance program.

But, I’d argue even that many times people loose sight of the big picture even when implementing an ISMS or any program for that matter. You can perform risk assessments until you are blue in the face, but good security starts with rational in mind. Rational from the end user all the way up to the person running the program.

I agree that security programs are good, but never loose focus on the primary objective - protect the data and the systems holistically.

]]>