“We read the guidance but we don’t know what falls out of scope!” is the universal merchant complaint. “Where are the audit guidelines?” is the second most common criticism. On August 12, 2011, the PCI task force driving the study of tokenization published an “Information Supplement” called the PCI DSS Tokenization Guidelines. The merchant community was less than thrilled. The problem is that the PCI document is sorely lacking in actual guidance. Even the section on “Maximizing PCI DSS Scope Reduction” is a collection of broad security generalizations rather than practical advice. After spending the better part of two weeks on this wishy-washy paper we propose a better title, “Begrudging Acknowledgement of Tokenization Without Guidance”.

But we are here to fix that, filling the gaps they left. This is the white paper the PCI Council should have written, addressing merchants’ pressing questions and providing pragmatic advice on how to implement a tokenization solution. The paper is the product of hundreds of hours of research and about a hundred phone calls to various merchants, payment processors, tokenization vendors, and qualified assessors. We make many controversial assertions but we stand by them – we have vetted the content through interviews in discussions with every expert we could reach. And we have subjected our analysis to open scrutiny by the payment community through our Totally Transparent Research process. We include an overview analysis for merchants and auditors, as well as a step by step guide which works through all the PCI DSS requirements which are directly affected when using tokens to replace primary account numbers.

We would like to thank Elavon, Liaison, Prime Factors, and Protegrity for sponsoring this research.

Download: TokenGuidance-Securosis-Final.pdf