Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I am working on a project to get our company PCI Compliant. One of the key issues I face is managing PCI/Security policies in the organisation.

I am responsible for creating the policies and distributing it. I find on many occasions when I hand over a policy that the user does not sign the document or maintain it. There seems to be a lot of admin overhead just trying to get people to sign the documents.

Does anyone know of software that can be used to automate the processes and maintenance surrounding policies?

Key features I believe is important are:

  • Automated way of getting users to acknowledge new policies/updated policies
  • Assigning owners
  • Templates for formulation of new policies

Any suggestion would be great. We are on a tight budget so I need a cost effective solution.

share|improve this question

put on hold as off-topic by Jens Erat, Neil Smithline, Graham Hill, Xander, Iszi yesterday

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

7 Answers 7

I would recommend using a wiki to store the policies, you then get versioning, etc. You can also create templates which include the document control information you need to evidence such as the change date, approval date, effective date, etc. You could probably get away with a lightweight wiki, but if you have SharePoint or KnowledgeTree those might be the way to go. Semantic Media Wiki might also be a good choice. The wiki route is also good because you can embed keywors and tags, such as the applicable PCI requirements which makes it much easier to track individual policies and cross reference.

If we look at the PCI Scoring Guidance, we see that 12.6.2 says

12.6.2 Verify that the security awareness program requires personnel to acknowledge, in writing or electronically, at least annually that they have read and understand the information security policy

Always consult with your own QSA, but if you have a small enough group, you can probably combine this somehow with your annual training in 12.6.1; do a training session with a sign-in sheet and another column for policy sign-off.

If you use outlook, you can use the voting button functionality to collect responses, but you would probably be best served implementing some type of survey web-app that allows you to build survey questions. You could be extra rigorous and test them on what they read, but your basics would be a name field, a checkbox, and maybe an additional field for initials for a digital sign-off. If you use SharePoint, again this can be used to collect surveys.

I don't have any familiarity, but I did a quick search and came up with these:

share|improve this answer

I'm not aware offhand of any particular system that does that, although I'm sure such systems exist. That being said, in my experience the software you're looking for is a human.

  1. People ignore reminder emails from a system, humans are harder to ignore.
  2. The human can apply knowledge as to areas of responsibility and ensure that the right people are being reminded.
  3. The human can apply translation skills between the PCI/QSA requirements and the business's established documentation base that a system can't.
  4. In short, PCI compliance is a project management problem, and software doesn't manage projects, people do.

Yes, these duties will tie up significant resources from that human at least once a year. Depending on why you need PCI compliance, it may be worth it (a merchant may place less value on perfecting their compliance audit process than a payment processor, for example; the penalties for losing compliance are more severe for the latter). Unfortunately, that's the name of the compliance game. Many people say you shouldn't confuse compliance with security - you also shouldn't assume it can be done efficiently.

share|improve this answer

My last company used EtQ Reliance. But it also wasn't cheap or easy to use.

Prior to EtQ we used a paper based system and made sure to follow the rule if you aren't trained on a document and signed off then you can't do what ever that document is for. And managers of a process can't get it in production without getting their documentation done and signed off.

It all takes a whole lot of time though.

share|improve this answer

I'm not sure this is an issue best addressed with a techncial solution.

Your management team have decided, I presume, that it is a business requirement to get PCI compliance? (If not, then why would you be trying for it?)

Then if you have a user who won't put the work in, their boss needs to yell at them until they do. Corporate policies are not optional.

(Now, I'm not saying that you shouldn't be looking to make the system work smoother for your users. You should always be trying to do that. But: they're not allowed to skip the work in the meantime.)

share|improve this answer

There may be a more custom solution out there, but I find that an easy-to-use internal wiki is usually the best approach. It allows many users to update the policies, provides version control, and allows everyone easy access to the latest version of the company policy for all employees.

It doesn't address your concern about individuals signing the policy but DSS point 12.6.2 only requires personnel to acknowledge annually that they have read and understood the policy. This can be done digitally through email or otherwise; it doesn't have to be a physical signature.

Here are some of the Wiki's I'd recommend:


Since posting this, I have observed using a wiki for acknowledgements as well. As long as each user has their own account, You can create a page for the year's signatures (i.e. "2015 Policy Acknowledgements") and everyone can edit that page and add their name that they attest they have read/accept the policies in the Wiki. Since the Wiki is version controlled and usually allows page diffs for historical changed, you'll be able to see that each unique user account added their name to the page. It provides as much assurance as email with the benefit of maintaining all acknowledgements on one clear page.

Here is an example change log from Django Wiki showing the change and the user that made the change:

enter image description here

share|improve this answer

I am unsure if you have found a solution but if not check out - MetaCompliance Policy Management Software Solution This is a Policy Management system that is great for creating the policies and distributing them to staff and third party vendors. It automates the distribution of policies and has an enforcement features that ensures staff sign up. Every response is captured and displayed in easy to read audits and reports. I hope this helps (Karen McNaught, Marketing Manager Metacompliance).

share|improve this answer
Thanks for your edit! – schroeder Nov 26 at 15:56

I would like to recommend MetaCompliance - they have a suite of Policy Management Software Solutions (SaaS) which cover Governance, Risk and Compliance (GRC), Information Security and Assurance. Their software encourages maximum user participation when dealing with these areas.

The software is compliant to ISO 27001, ITIOL and COBIT Governance Frameworks and includes an execellent series of reporting tools which include metrics around learning content actvity, risk management and production of reports for auditors and regulators.

It works on mobile devices

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.