P2PE: Understanding new guidance on assessing non-listed encryption solutions
Point-to-Point Encryption (P2PE) technology makes data unreadable so it has no value to criminals even if stolen in a breach. Merchants can take advantage of this technology with a P2PE solution, a combination of secure devices, applications, and processes that encrypt payment card data from the point where a merchant accepts the payment card to the secure point of decryption. Only PCI P2PE Solutions are validated by a specially-trained P2PE QSA as meeting the rigorous security requirements of the PCI P2PE Standard and are listed on the PCI Security Standards Council (PCI SSC) website. These solutions can greatly simplify merchant efforts to comply with the PCI Data Security Standard (PCI DSS), by reducing where and how PCI DSS requirements apply. 

The Council continues to encourage merchants and acquirers to use the PCI SSC listing in selecting a PCI P2PE Solution. At the same time, it’s recognized that many solutions currently being used by merchants are not PCI-listed, which creates a challenge for assessors in how to complete PCI DSS assessments for these merchants. To help with this challenge, the Council recently issued Assessment Guidance for Non-listed Encryption Solutions to assist security assessors in evaluating non-listed encryption solutions and their impact on merchants’ PCI DSS compliance. The guidance is not meant to encourage the use of non-listed solutions. Instead, it’s meant to inform all parties involved in a merchant PCI DSS assessment how the use of a non-listed encryption solution impacts the merchant’s PCI DSS compliance responsibilities, compared to the use of a PCI P2PE Solution. It underscores the security and PCI DSS compliance benefits that PCI P2PE Solutions ensure and the assurance that comes with knowing these solutions are independently tested and validated as meeting the requirements of the PCI P2PE Standard.

Point-to-point encryption is a critical technology for devaluing payment data. With this guidance and our growing PCI P2PE Solution listing, we hope to encourage merchant adoption of P2PE for the strongest protection for payment card data.

For more information on this guidance, please read PCI Perspectives blog post, “P2PE: Assessing Non-Listed Encryption Solutions”.

 > Read the blog

2017 SIG: Vote by 1 December
This is your last chance to choose next year’s Special Interest Group (SIG) project!

SIG initiatives focus on specific payment security challenges that the PCI community wants guidance on addressing.

For 2017, instead of choosing new Special Interest Group topics, we’re asking you to vote on which existing SIG guidance you’d like the PCI community to update:

• Please log in to the Participating Organization portal today to review your choices and take a few minutes to cast your vote.
• Note: The voting period closes on 1 December, and we’ll announce the results in early January with information on how you can join the Special Interest Group.

Involvement in Special Interest Groups is a great way to provide your expertise to the Council and develop practical payment security resources for the industry.

 > Vote now

SMB security tips for the holiday shopping season
Just in time for the holiday shopping season, the Council created a new resource to provide small and mid-sized businesses quick tips to protect their online business. The one-page visual resource outlines three ways to protect payment card data. Additionally, take a look at the latest post on the PCI Perspectives blog with more payment security insights for small and mid-sized merchants.

Before the holiday break Council General Manager Stephen Orfei authored a post with Ann Beauchesne of the National Security & Emergency Preparedness Department for the National Chamber of Commerce blog, "Above the Fold". The post, entitled "Cyber Monday and How to Protect Your Business", aims to help small and mid-sized businesses protect cardholder data during the busy holiday season. Finally, to help small businesses prior to Small Business Saturday, the Council authored a guest post on the National Cyber Security Alliance blog entitled, "Security Checklist for Small Business Saturday".

 > View the blog series