PCI Policy Management software?

Question

I am working on a project to get our company PCI Compliant. One of the key issues I face is managing PCI/Security policies in the organisation.

I am responsible for creating the policies and distributing it. I find on many occasions when I hand over a policy that the user does not sign the document or maintain it. There seems to be a lot of admin overhead just trying to get people to sign the documents.

Does anyone know of software that can be used to automate the processes and maintenance surrounding policies?

Key features I believe is important are:

• Automated way of getting users to acknowledge new policies/updated policies
• Assigning owners
• Templates for formulation of new policies

Any suggestion would be great. We are on a tight budget so I need a cost effective solution.

Answer 1

I'm not sure this is an issue best addressed with a techncial solution.

Your management team have decided, I presume, that it is a business requirement to get PCI compliance? (If not, then why would you be trying for it?)

Then if you have a user who won't put the work in, their boss needs to yell at them until they do. Corporate policies are not optional.

(Now, I'm not saying that you shouldn't be looking to make the system work smoother for your users. You should always be trying to do that. But: they're not allowed to skip the work in the meantime.)

Answer 2

I would recommend using a wiki to store the policies, you then get versioning, etc. You can also create templates which include the document control information you need to evidence such as the change date, approval date, effective date, etc. You could probably get away with a lightweight wiki, but if you have SharePoint or KnowledgeTree those might be the way to go. Semantic Media Wiki might also be a good choice. The wiki route is also good because you can embed keywors and tags, such as the applicable PCI requirements which makes it much easier to track individual policies and cross reference.

If we look at the PCI Scoring Guidance, we see that 12.6.2 says

12.6.2 Verify that the security awareness program requires personnel to acknowledge, in writing or electronically, at least annually that they have read and understand the information security policy

Always consult with your own QSA, but if you have a small enough group, you can probably combine this somehow with your annual training in 12.6.1; do a training session with a sign-in sheet and another column for policy sign-off.

If you use outlook, you can use the voting button functionality to collect responses, but you would probably be best served implementing some type of survey web-app that allows you to build survey questions. You could be extra rigorous and test them on what they read, but your basics would be a name field, a checkbox, and maybe an additional field for initials for a digital sign-off. If you use SharePoint, again this can be used to collect surveys.

I don't have any familiarity, but I did a quick search and came up with these:

• policyIQ (commerical policy management software)
• Power DMS - Policy Workflow (another commercial solution)

Answer 3

I'm not aware offhand of any particular system that does that, although I'm sure such systems exist. That being said, in my experience the software you're looking for is a human.

1. People ignore reminder emails from a system, humans are harder to ignore.
2. The human can apply knowledge as to areas of responsibility and ensure that the right people are being reminded.
3. The human can apply translation skills between the PCI/QSA requirements and the business's established documentation base that a system can't.
4. In short, PCI compliance is a project management problem, and software doesn't manage projects, people do.

Yes, these duties will tie up significant resources from that human at least once a year. Depending on why you need PCI compliance, it may be worth it (a merchant may place less value on perfecting their compliance audit process than a payment processor, for example; the penalties for losing compliance are more severe for the latter). Unfortunately, that's the name of the compliance game. Many people say you shouldn't confuse compliance with security - you also shouldn't assume it can be done efficiently.

Answer 4

My last company used EtQ Reliance. But it also wasn't cheap or easy to use.

http://www.etq.com/reliance/

Prior to EtQ we used a paper based system and made sure to follow the rule if you aren't trained on a document and signed off then you can't do what ever that document is for. And managers of a process can't get it in production without getting their documentation done and signed off.

It all takes a whole lot of time though.

Answer 5

There may be a more custom solution out there, but I find that an easy-to-use internal wiki is usually the best approach. It allows many users to update the policies, provides version control, and allows every easy access to the latest version of the company policy for all employees.

It doesn't address your concern about individuals signing the policy but DSS point 12.6.2 only requires personnel to acknowledge annually that they have read and understood the policy. This can be done digitally through email or otherwise; it doesn't have to be a physical signature.

Here are some of the Wiki's I'd recommend:

• TWiki - Free
• DokuWiki - Free
• Confluence - Payed