Q

Avoiding conflicts of interest in PCI security assessments

Network security audits should not be performed by the same individual who later patches the network security holes found by that network security audit.

I recently became a qualified assessor. Previously, I conducted scans for my customers and fixed vulnerabilities that would prevent them from passing a QSA-conducted scan. Is it acceptable for me to fix the problems I find in the scans I find as their QSA? I'm thinking it might be better to have a separation of duties here.

Section 2.2 of the PCI Validation Requirements for Qualified Security Assessors (QSA) v. 1.1 calls for "auditor independence" within the QSA program precisely to avoid the type of conflict of interest that you are worried about. In discussing this issues with others in the industry, it is generally accepted that policies be put into place that mandate a separation of duties between QSA Auditors and QSAs, or other individuals within a QSA certified company who provide remediation support.

This was last published in June 2007

Dig Deeper on Regulatory Compliance

PRO+

Content

Find more PRO+ content and other member only offers, here.

Have a question for an expert?

Please add a title for your question

Get answers from a TechTarget expert on whatever's puzzling you.

You will be able to add details on the next page.

Start the conversation

Send me notifications when other members comment.

By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Please create a username to comment.

-ADS BY GOOGLE

MicroscopeUK

SearchCloudProvider

SearchSecurity

SearchStorage

SearchNetworking

SearchCloudComputing

SearchConsumerization

SearchDataManagement

SearchBusinessAnalytics

Close