Comments on: Sample PCI-DSS Policy Part 6: Roles and Responsibilities http://www.pcidssguru.com/policy/roles-and-responsibilities/ Practical Implementation Guidance on the Payment Card Industry Data Security Standard Tue, 31 Jan 2012 16:19:53 +0000 hourly 1 http://wordpress.org/?v=3.2.1 By: Chuck http://www.pcidssguru.com/policy/roles-and-responsibilities/comment-page-1/#comment-15346 Chuck Tue, 24 Jan 2012 15:12:36 +0000 http://www.pcidssguru.com/?p=103#comment-15346 I subscribed to the newsletter. can you please send the policy template to me? I subscribed to the newsletter. can you please send the policy template to me?

]]> By: Mike http://www.pcidssguru.com/policy/roles-and-responsibilities/comment-page-1/#comment-2425 Mike Tue, 05 Apr 2011 10:36:54 +0000 http://www.pcidssguru.com/?p=103#comment-2425 Please remember the PCI standard is there to protect your data. Just re-writing existing peoples work isn't ideal. You will tend to skip other the actual point of the standard in favour of the "just tick the box" method. You (depending on your merchant level) need to prove what you say in the policies. I had to write up something like 26 new policies. And document how, why and when certain procedures are performed. All employee's had to re-sign a acceptable use policy etc etc etc....it is alot of work but worth it. Please remember the PCI standard is there to protect your data. Just re-writing existing peoples work isn’t ideal. You will tend to skip other the actual point of the standard in favour of the “just tick the box” method.

You (depending on your merchant level) need to prove what you say in the policies. I had to write up something like 26 new policies. And document how, why and when certain procedures are performed. All employee’s had to re-sign a acceptable use policy etc etc etc….it is alot of work but worth it.

]]> By: Andrew http://www.pcidssguru.com/policy/roles-and-responsibilities/comment-page-1/#comment-1355 Andrew Tue, 28 Sep 2010 20:12:48 +0000 http://www.pcidssguru.com/?p=103#comment-1355 Is just rewriting all of this enough for the security policy. Do we have to create a whole incident response policy that goes in detail through the questions of 12.9.1? Is just rewriting all of this enough for the security policy. Do we have to create a whole incident response policy that goes in detail through the questions of 12.9.1?

]]>