Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

Does anyone know of PCI compliance management software (specifically PA-DSS, but I'm assuming any kind of PCI-DSS software will do PA-DSS)? Mainly for our application end. We have a 3rd party site but I'm looking for something we can host in house that I can allocate permissions to individual team members to do primary signing before we go through and have management sign off on it. Just some kind of rudimentary system of documentation that we can track who changes it and when.

Currently we have binders of paper, I'm really not liking this because of how inflexible it is, and the amount of paper we can go through with various iterations.

I've been tempted to just drop the entire compliance document into a wiki template and drop the template into a per-project documentation setup, but it sounds like a huge pain to do in the first place, and wouldn't be nearly as friendly for the developers (not that learning Wiki markup is hard, but keeping track of where you are in the template will probably be annoying).

Anyone have any better ideas?

Edit:

Basically I want a digital version of this checklist:

https://www.pcisecuritystandards.org/documents/pa-dss_v2.pdf

That I can see who filled it out, and go back and check earlier revisions, we'll go ahead and keep physical copies once new software is complaint, but this will be used as a tool to easily check and know when the last check was done, and how compliant we are in various projects.

Edit 2:

If not, this seems like a simple enough project to be my venture into releasing some FOSS. :)

share|improve this question
1  
How about a spreadsheet and some version control? – Jeff Ferland♦ Oct 6 '11 at 12:08
We currently use Visual Source Safe for source control which is terribly cumbersome outside of projects, but that is a fairly straightforward solution and would be pretty easy to implement. I'll keep it in mind if no one has any other suggestions. – StrangeWill Oct 6 '11 at 16:29
@StrangeWill have you managed to find anything already out there in the FOSS world that could be adapted to your needs? I am looking for something similar for managing Common Criteria projects which have an existing framework like PCI-DSS to be tracked through. – logicalscope Jan 7 '12 at 0:14
I wrote a macro for Confluence, so far that is the best I got (although macros were never made to do this, so it can be cumbersome), I've also contemplated writing my own small PHP site just for handling this and archiving responses over time. – StrangeWill Jan 7 '12 at 2:36
Though I'd argue the macro falls really short, I'm really tempted to start up an open source project for this that relies on Apache auth (so LDAP, .htpass, etc.), I'll post it if I start it. – StrangeWill Jan 14 '12 at 21:34

migrated from stackoverflow.com Oct 6 '11 at 8:35

1 Answer

up vote 1 down vote

Unless you are looking for some integrated Audit management software, you should be fine with a Document Managment system (DMS) like SharePoint or KnwoledgeTree. Using sharepoint you can setup hierarchies and track documents, screenshots, etc. for your ROC. In my firm we use SharePoint forms and file management to link everything together for this purpose. You might want to play around with some other options in the document management space or collaborative WebDAV system, or some hybrid like Barracuda Server.

I know there are some general IT audit management and compliance programs on the market, but they are probably overkill for what you are trying to do with organizing PCI evidence.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.