Many mid-sized businesses struggle with achieving and maintaining PCI compliance. Some lack the necessary resources—technology or security staff—while others struggle with the complex processes and technology involved.

As someone responsible for IT and Security, you have little choice but to incorporate PCI data security standards into your ever-growing list of responsibilities. Don’t count on sympathy or extra budget. So how do you comply without breaking the bank or hiring expert help? Here are 3 easy steps to help you manage PCI compliance with limited resources.

1. Identify and maintain PCI Scope The first step is to determine the scope of the task. Make a list of all networks, systems, personnel and applications responsible for storing, transmitting and processing credit card data. The scope will help you better define the resources you need to assess and monitor against the PCI control requirements throughout the organization.

2. Implement and manage security solutions  The second step is to implement and manage a security solution that fits your budget, while being comprehensive enough to address all PCI control requirements. Fortunately, there are many open source and cost-effective solutions that can be implemented with smaller budgets. Below are some examples of solutions that can help mid-sized companies easily comply and maintain compliance. Note that these are must-have software technologies for any mid-size company wishing to comply with PCI:

• PCI-Approved Malware/Anti-Virus Protection – Norton Antivirus: https://us.norton.com
• Credit Card Detection Software – Powergrep: http://www.powergrep.com
• File Integrity Monitoring – OSSEC (Open Source HIDS SECurity): http://www.ossec.net (best thing about this? – its free!)
• Trend Micro Deep Security IDS/IPS – OSSEC: http://www.ossec.net
• External / Internal Vulnerability Scanning tool – FortifyData Cyber Risk Platform
• Risk Management tool – FortifyData Cyber Risk Platform

3. Manage internal control audits The third step is managing your internal control mechanisms. Many businesses utilize Excel spreadsheets for tracking and managing tasks for PCI control requirements, but this is highly ineffective and time consuming. The best approach is to leverage a compliance management system which lists all PCI security requirements and maps them to specific tasks assigned to personnel. This enables you to track recurring PCI tasks, and will make the recertification process relatively straightforward.

It’s easy to get lost trying to find the best PCI compliance tools to help you manage your internal controls. A quick search online will give you an abundance of software solutions that can manage this task for you, and admittedly some of them do a decent job. However, they don’t offer a complete picture of your cyber risk exposure, in addition to helping you manage your compliance obligations.

That’s what we do at FortifyData. Not only do we help you manage your internal controls to ensure PCI compliance, we also provide a comprehensive assessment of your cyber risks related to infrastructure, personnel, and processes to help you manage a cybersecurity compliance management cybersecurity compliance management program.

So, if you’re looking for a cost-effective way to easily manage your PCI compliance program as part of your larger information security strategy, we’re here to help.