News for hackers. Stuff that matters.

A comment on Chase did a bad thing, so we did a good thing. Parent comment

Re:Chase did a bad thing, so we did a good thing by toomuchtodo on Tuesday June 11, 2019 @08:23PM (#20160729)
Sort of humorous comment, as PCI DSS is self assessment and attestation of compliance. If OP states they’ve met their burden, that’s all that’s required at their scale.
[ Parent | on HN ]
Re:Chase did a bad thing, so we did a good thing by snazz on Tuesday June 11, 2019 @08:30PM (#20160759)
Really? I evidently know nothing of the matter, but you're saying that the auditors only get involved when they become a larger operation?
[ Parent | on HN ]
Re:Chase did a bad thing, so we did a good thing by toomuchtodo on Tuesday June 11, 2019 @08:33PM (#20160777)
Yep. Card networks can also unilaterally decide your level.

https://www.pcicomplianceguide.org/faq/#4

Disclaimer: I work in governance/risk/compliance, but have not performed PCI compliance work in the last several years.

[ Parent | on HN ]
Re:Chase did a bad thing, so we did a good thing by gowld on Tuesday June 11, 2019 @08:51PM (#20160837)
PCI DSS assessments are signed by natural persons, not arbitrary HTML content.
[ Parent | on HN ]
Re:Chase did a bad thing, so we did a good thing by toomuchtodo on Tuesday June 11, 2019 @10:12PM (#20161169)
Natural persons who are rarely, if ever, pursued when breaches occur.
[ Parent | on HN ]