The following is my bitch about the PCI Security Standards Council.

“Hey..WTF?”, you may say, “Draz, you have been a huge supporter of PCI DSS for a long time!…We always see you in the press being quoted on the positives of PCI DSS and we read stuff in Beast or Buddha all the time about your positive thoughts on it!”…..Yeah, I have been, but my patience/interest with the “governing” body is in some serious problems! Where do I start…no particular order:

1. Their care factor in Asia Pacific is small. Fair enough, the US market is far larger, but to only run 1 cert and re-cert per year in all of Asia Pacific per year is hard. Most of us have to travel 8-10 hours on a plane plus the expenses to do it. (Talking about Australia). Forgetting the cost factor – compare that to the number of courses in the US. At least give us 2-3 more options if you are serious about this being a global program! Don’t then tell us that much of the CC fraud problem stems from this region and this region lags behind the US in terms of business compliance with PCI DSS.

2. Personal: I have spent the last 2,3,4 months….I’ve lost track of how long I have been trying to explain to them that Security-Assessment.com Australia/Asia Pacific has renamed to Securus Global and could our details be updated on their site. I’ve done all they have asked and all that has happened is that we’ve gone around in circles. So now, their biggest supporter here is not even registered as a QSA – even though paid up on the large yearly fee! I won’t go into detail of the BS that has gone on to the detriment of both SG and SA in recent weeks.

3. Who is running the show? Has the Payment Card Industry outsourced all accountability and ownership?