PCI: Retail therapy
PCI: Retail therapy

Guidelines on cloud computing have been released by the PCI security standards council.

With an aim to offer a resource for businesses in choosing solutions and third-party cloud providers, the guidelines were developed by PCI special interest groups to answer common questions.

The main objectives are to provide an explanation of common deployment and service models for cloud environments, including how implementations may vary within the different types, compliance challenges in a cloud environment and determining and documenting responsibilities to the different cloud models and guidance.

The document also includes a number of appendices to address specific PCI DSS requirements and implementation scenarios, including: additional considerations to help determine PCI DSS responsibilities across different cloud service models; sample system inventory for cloud computing environments; sample matrix for documenting how PCI DSS responsibilities are assigned between cloud provider and client; and a starting set of questions that can help in determining how PCI DSS requirements can be met in a particular cloud environment.

Chris Brenton, PCI Special Interest Group contributor and director of security for CloudPassage, said: “One of cloud computing's biggest strengths is its shared-responsibility model. However, this shared model can magnify the difficulties of architecting a secure computing environment.

“One of this supplement's greatest achievements is that it clearly defines the security responsibilities of the cloud provider and the cloud customer. With PCI DSS as the foundation, this guidance provides an excellent roadmap to crafting a secure posture in both private and public cloud.”

Bob Russo, general manager of the PCI Security Standards Council, said: “At the council, we always talk about payment security as a shared responsibility. And cloud is by nature shared, which means that it's increasingly important for all parties involved to understand their responsibility when it comes to protecting this data.

“It's great to see this guidance come to fruition, and we're excited to get it into the hands of merchants and other organisations looking to take advantage of cloud technology in a secure manner.”