PCI Requirement 3.1 – Keep Cardholder Data Storage to a Minimum

by Randy Bartels / December 22, 2022

PCI Requirement 3.1 requires organizations to securely delete data that is not required to be retained for business or legal requirements. Why is complying with PCI Requirement 3.1 important? So that cardholder data cannot be recreated by malicious individuals. PCI Requirement 3.1 states that organizations should, “Keep cardholder data storage to a minimum by implementing data retention and disposal policies, procedures, and processes…” PCI Requirement 3.1 aligns with the methodology…

Cyber Insurance – What Is It and What is Covered Under a Cyber Insurance Policy?

by Benjamin Wright / December 19, 2022

Cyber insurance – a hot topic in the law of data security. Many insurance companies have started issuing policies for cyber incidents and cyber breaches – But, what should be covered under a cyber insurance policy? Since there is no standard policy for cyber insurance, you are likely to find vastly different policies from a number of difference insurance companies. Enterprises looking to use insurance to manage information security risk…

3 Data Security & Privacy Best Practices for Your Employees

by Benjamin Wright / December 19, 2022

Why is Data Security & Privacy Important? It is considered best practice, and often required, for organizations to develop, document, and implement an information security policy. An information security policy acts as an agreement with employees with respect to data security and privacy best practices. This set of policies is often seen in the form of a binding employee handbook, or contract, and should be updated on an annual basis,…

PCI Requirement 2.6 – Shared Hosting Providers Must Protect Each Entity’s Hosted Environment

by Randy Bartels / December 22, 2022

What is a Shared Hosting Provider? PCI Requirement 2.6 exists to protect hosting environments. When multiple clients’ data is all on the same server, the security of the server often becomes susceptible to vulnerabilities. For example, one client could create insecure functions, but because the data is under the control of a single environment, the other clients’ data would also become compromised. This is why PCI Requirement 2.6 requires that…

PCI Requirement 2.5 – Ensure Security Policies Are Known to All Affected Parties

by Randy Bartels / December 22, 2022

Ensure that Policies and Procedures are Documented, In Use, and Known to All Affected Parties PCI DSS Requirement 2.5 addresses one of the most important aspects of the assessment. It directs, “Ensure that security policies and operational procedures for managing vendor defaults and other security parameters are documented, in use, and known to all affected parties.” If vendor defaults and other security measures are not continuously managed, it’s harder to…