Feedback – Transaction Monitoring and PCI

There is nothing that can quite substitute time spent with a end-user or end-customer listening to their direct feedback.  Interactive’s Interactions’09 User Forum came to a close Thursday noon.  There was a very positive and upbeat spirit at the conference.  One of the things that we emphasized this year over previous years was customer to customer relationships and stories.  I didn’t think it was possible, but we even had a couple of large sessions without PowerPoint.  We instead let our customers drive those sessions with both questions and answers.  I heard from a number of customers that they found significant value in those sessions.

Okay, well, the title of this post mentions PCI DSS and transaction monitoring.  I did want to take a minute to share some of the feedback I received on these topics.  A large percentage of the participants at our conference take transactions over the phone and are therefore impacted by PCI DSS (payment card industry data security standards).  However, only a small number have gone the full extent to become certified compliant.  Why is that?  One key reason is that the 12 requirement points to PCI are broken down into milestones and priority.  Organizations are pushed to address the top priority aspects of the requirements quickly but are given a more lenient time table for meeting lower priority requirements.

Here are the prioritizations for PCI DSS compliance efforts:




Remove sensitive authentication data and limit data retention. This milestone targets a key area of risk for entities that have been compromised. Remember – if sensitive authentication data and other cardholder data are not stored, the effects of a compromise will be greatly reduced. If you don’t need it, don’t store it.


Protect the perimeter, internal, and wireless networks. This milestone targets controls for points of access to most compromises – the network or a wireless access point.


Secure payment card applications. This milestone targets controls for applications, application processes, and application servers. Weaknesses in these areas offer easy prey for compromising systems and obtaining access to cardholder data.


Monitor and control access to your systems. Controls for this milestone allow you to detect the who, what, when, and how concerning who is accessing your network and cardholder data environment.


Protect stored cardholder data. For those organizations that have analyzed their business processes and determined that they must store Primary Account Numbers, Milestone Five targets key protections mechanisms for that stored data.


Finalize remaining compliance efforts, and ensure all controls are in place. The intent of Milestone Six is to complete PCI DSS requirements and fi nalize all remaining related policies, procedures, and processes needed to protect the cardholder data environment.

Now regarding “transaction monitoring”… there is a distinction between quality monitoring and transaction monitoring for organizations taking transactions in their contact center.  The difference with transaction monitoring is that you are monitoring for more than just quality.  You are monitoring for inaccuracies that could cause the transaction to be defective.  The goal with transaction monitoring is to report separately on these defective errors from softer skills such as professionalism.  Just like we are seeing more organizations move down prioritized PCI compliance list we are seeing organizations looking for ways to report separately on potentially defective transactions.

Thanks for listening.  I look forward to your comments and your feedback!  For our US readers, have a great holiday weekend!  

Pete’s Out – Blogger by nature