Security awareness and compliance are always top of mind in the payment card industry. At least they should be. Unfortunately, too many companies still fail to uphold to the benchmarks of the industry’s data security standard (PCI DSS), which states businesses must “implement a formal security awareness program to make all personnel aware of the importance of cardholder data security,” as well as educating personnel “upon hire and at least annually.” In fact, the percentage of fully compliant firms has sunk in recent years to 28 percent, according to Verizon’s 2020 Payment Security Report. Not only does this mean costly fines for many, but it puts them at greater risk of a data breach, which can lead to consequences that are far worse. For Fullsteam™, a leading software and payments provider with more than 35 companies under its umbrella, security and compliance are an even greater ongoing concern because failure to comply could affect the viability of the FullsteamPay payments platform and its payment processing capabilities. It could suffer reputational damages and rising insurance rates, and hinder its ability to win over new merchants—in effect, many of the same costs incurred by businesses that suffer an actual breach. So, Fullsteam is hardwired in its attention to the cybersecurity landscape and its determination to always meet the payment industry’s regulatory obligations. Security Awareness Needed to Be Fully Effective, Not Simply Check a Box Even with the right mindset and strategic planning, however, Fullsteam faced significant challenges in delivering a security awareness program that could get its ever-growing number of employees from continuous acquisitions up to speed quickly. In the words of Jon Armstrong, Fullsteam’s Director of IT & Security, “Generally speaking, annual security awareness training is completely ineffective because it is never timely, and it is always the same because no one bothers to update it.” What’s more, Fullsteam sought a centralized, highly automated solution that wouldn’t require its IT team to direct countless hours in developing and maintaining the program. Armstrong and his team need to focus on business initiatives that grow the success of the company and are busy enough without having to add security awareness training to their to-do list. It’s unrealistic and ultimately unproductive for them to have to curate and deliver content on a regular basis to ensure it’s up to date and keeps employees focused on cyber hygiene. Ultimately, Armstrong sought to find a provider that would do more than help the company be PCI compliant organization wide. He also wanted to ensure all employees understood that they were expected to be responsible individually and collectively for demonstrating and maintaining proper cybersecurity behavior based on best practices to continually raise Fullsteam’s IT security posture—and that Fullsteam would provide the solution for them to meet those expectations.
Read More