PCI DSS vs ISO/IEC 27001: How Do These Compare and Can They Be Aligned

Completing a Payment Security Practitioner course recently made me want to explore the potential relationship between PCI DSS and ISO/IEC 27001 — a standard I already work closely with. Taking the perspective of an organisation where both of these apply, in this article we’ll explore the similarities, differences, and perhaps the areas in which the two standards complement each other.

The Payment Card Industry Data Security Standard (PCI DSS) and ISO/IEC 27001 are two important standards in the realm of information security, with each having its own focus and application.

What is PCI DSS

PCI DSS is a specific, detailed framework designed for organisations that handle payment cards, cardholder data, or sensitive authentication data. It aims to secure credit and debit card transactions against data theft and fraud. PCI DSS sets out stringent requirements for the handling, processing, and storage of cardholder data, providing a clear pathway to secure payment card environments. To this effect, it includes six goals and 12 requirements, such as maintaining a secure network, protecting cardholder data, and maintaining an information security policy.

What is ISO/IEC 27001

ISO/IEC 27001, on the other hand, offers a broader perspective. This international standard outlines the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS) within the context of an organization’s overall business risks. It focuses on a holistic approach to securing all forms of information, not just cardholder data, making it applicable across various industries and business models.

From this brief introduction it is clear that both PCI DSS and ISO/IEC 27001 should not be seen simply as compliance obligations but as critical tools for the success of an organisation’s information security programme.

Comparing the Two standards

Next, let’s look at the two standards from a few key standpoints:

1. Scope and Application:

• PCI DSS: Focused specifically on the security of cardholder data for organisations handling payment data. It is more prescriptive, detailing specific technical and operational requirements. The set of security controls developed by the PCI Security Standards Council is called the Payment Security Management System (PSMS).
• ISO/IEC 27001: Broader in scope, suitable for any organisation seeking to manage its information security risk. It is more flexible, providing a framework for an Information Security Management System (ISMS) without being too prescriptive.

2. Control Objectives and Requirements:

• PCI DSS: Six control objectives encompassing 12 specific requirements. Its focus is more on technical and operational controls directly related to cardholder data protection.
• ISO/IEC 27001: Comprises of 14 control domains with 114 controls in its annex. These controls are broader, covering various aspects of information security management, beyond just data protection. Organisations can pick just a subset of controls which are relevant to the scope and risks they’ve identified.

3. Compliance and Certification:

• PCI DSS: Requires annual validation of compliance, which can vary based on the volume of transactions and the entity’s role in the payment process.
• ISO/IEC 27001: Certification involves a two-stage audit process and is generally reviewed every three years, with periodic surveillance audits.

4. Implementation and Management:

• PCI DSS: Emphasises specific technical measures and operational procedures, often requiring detailed and technical implementations tailored to payment card security.
• ISO/IEC 27001: Focuses on establishing, implementing, maintaining, and continually improving an ISMS. It is more strategic and management-focused, requiring a risk assessment and treatment process.

Integrating the Two Standards

Now that we’ve roughly compared the two standards, let’s continue by exploring some areas of overlap and integration between PCI DSS and ISO/IEC 27001, focusing on how they can be effectively aligned.

1. Network Security:

• PCI DSS: Mandates specific requirements like firewall configurations, encryption, and intrusion detection systems to protect cardholder data.
• ISO/IEC 27001: Includes controls on network security management but is less prescriptive, allowing organisations to choose appropriate security measures based on their risk assessment.
• Integration: Organisations can align PCI DSS’s specific network security requirements within the broader framework of ISO/IEC 27001, ensuring that all network security measures not only protect cardholder data but also align with the overall information security strategy.

2. Access Control

• PCI DSS: Requires detailed controls for access to cardholder data, including authentication and authorisation mechanisms.
• ISO/IEC 27001: Provides a broader set of controls on access control, considering all types of information assets.
• Integration: By mapping PCI DSS access control requirements to ISO/IEC 27001’s controls, organisations can create a comprehensive access control system that secures cardholder data while also fitting neatly into the larger ISMS.

3. Information Security Policies:

• PCI DSS: Includes requirements for policies specific to the protection of cardholder data and payment security.
• ISO/IEC 27001: Requires an overarching set of information security policies, applicable to all information assets.
• Integration: Organisations are recommended to develop information security policies that meet both standards, ensuring that policies specific to cardholder data protection are part of the broader set of information security policies.

4. Risk Management:

• PCI DSS: Implicitly involves risk management in its requirements, but it is not explicitly focused on a risk-based approach.
• ISO/IEC 27001: Centrally involves establishing and maintaining a risk management process. A risk register is a key component of the ISMS.
• Integration: Implementing ISO/IEC 27001’s risk management process can help in identifying and mitigating risks related to cardholder data, thus aiding in PCI DSS compliance. These risks can sit alongside the organisation’s other risks which have been identified.

5. Monitoring and Continuous Improvement:

• Both standards emphasise the importance of regular monitoring, testing, and improving security controls.
• Integration: Organisations can use ISO/IEC 27001’s emphasis on continuous improvement to also enhance their PCI DSS compliance efforts, ensuring that the payment security controls remain effective over time.

Key Takeaways

What we listed above shows us that both standards can indeed be aligned effectively and integrated with each other. Many of PCI DSS’s requirements on network security, access control, and information security policies overlap with ISO/IEC 27001’s controls. Integrating these and treating them as common threads in our information security framework is beneficial both from an operational and a compliance point of view.

Organisations can integrate these standards by aligning PCI DSS’s detailed requirements with ISO/IEC 27001’s broader ISMS framework, creating a comprehensive approach to information security.