The PABP Compliance Threshold: We’re so over it

The Word arrived yesterday from Visa – via our Qualified Security Auditor (‘QSA’) – that our acquirer-side payment switch solution will be added to the List of Validated Payment Applications that have been assessed for compliance with the Payment Application Best Practices (‘PABP’).  We’d completed the effort a number of months ago, but Visa has been under a virtual deluge of submissions.  We’ll be on the list dated October 15, 2008. 

This isn’t a one-time effort though.  We’ll need to be reassessed and revalidated each year.  Like any effort of this nature, the first time is always the one that takes the most effort.  We are most fortunate to have my colleague Dave Bergert spearheading our compliance efforts.  What was eye-opening to me was that we (‘we’ = Dave) spent a minority of time addressing code shortfalls vs. PABP mandates, and a majority of the time compiling our PABP Compliance Guide (it’s important that we tell our users how to implement to assure compliance), creating and providing other supporting documentation, and shoring up our processes and procedures.  Our focus on process has always been strong. In the PABP era, it’s even better.

 The ‘Compliance Mandate’ at left gives you a good summary as to why this is so important to solution providers in the payment systems industry.  The original PABP announcement was very clear that Visa has determined that “[v]ulnerable payment applications have proved to be the leading cause of compromise incidents, particularly among small merchants.”  Anyone out there currently considering a payment switch is going to have ‘PABP Compliant App’ as a tick-box.  It you don’t have it, you aren’t playing.  There’s no finessing the point with a prospective buyer.

Here’s a passage from our press release on this news:

"We take the security of cardholder data seriously," said David Bergert (CISSP, CISA) of OLS.  "Obtaining our PABP certification ensures that when our customers implement OLS.Switch in accordance with its PABP Implementation Guide and within their PCI DSS-compliant environment, it will protect stored data and will not retain sensitive authentication data.  Our PABP validation also provides assurance that as a software vendor, we follow secure development processes and secure troubleshooting procedures.”