The Green Sheet :: Company Profiles

Living compliance daily

For many merchants, achieving Payment Card Industry (PCI) Data Security Standard (DSS) compliance remains difficult at best. They spend most of their waking hours concentrating on the bottom line, working to make their businesses thrive. The time, money and energy required to address PCI DSS issues can overwhelm merchants and pull them away from their core functions.

Also, the PCI DSS' 12 requirements are changing and growing in complexity as products and services in the payments industry evolve. Failure to comply with the requirements can result in fines, audits and additional in-house administrative and system management costs for merchants and their acquirers.

An ever-present host

Busy with many other aspects of merchant acquirers, many ISOs and merchant level salespeople (MLSs) seek partners willing to handle merchant PCI compliance full time.

They are turning to experts, such as GreenSoft Solutions Inc., to help merchants who have neither the wherewithal nor the desire to manage these matters in-house.

The demands of the PCI DSS have caused much anxiety for merchants who are afraid not only of becoming victims of cardholder data security breaches, but also of being fined for failing to meet security requirements. GSI hopes to ease those fears.

GSI specializes in managed hosting for companies with e-commerce sites that require a high level of security. "With regard to the payments industry, GSI has developed a dedicated hosting environment specifically for those clients that require their hosted applications to be located in a PCI DSS-compliant environment," said Terry Madden, Vice President – Strategic Markets for GSI.

"Many hosting providers simply provide physical security and leave the system management up to you," Madden said. GSI performs both tasks, allowing merchants to concentrate on their core business practices rather than monitor information technology (IT) environments.

Madden added that small and large companies consider GSI a partner in helping them achieve and maintain PCI compliance.

GSI strives to understand its clients' business operations by gathering as much detail as possible.

"We believe that the more we know about our customer and what is critical to their business, the better we can support them," Madden said.

A little-known niche

In 1996, when Internet commerce was in its infancy, GSI opened its doors as an application development organization. The company developed payment applications and helped e-commerce Web sites get up and running. "We've always been in hosting," Madden said.

Most of GSI's customers were large benefit-management companies, including those administering medical plans. As the use of credit and debit cards increased for doctor visits, GSI explored a new role.

"The card organizations demanded that we follow credit card compliances," Madden said. "We saw a hole in the market for high-security compliance."

GSI's philosophy is simple – get PCI DSS compliance done right. Accordingly, GSI takes a flexible business approach to optimize a plan to fit any client's needs and concentrate on client-centered solutions, Madden said.

GSI has built its credibility by receiving a number of industry certifications, and gaining authorization to support direct connectivity into the four major card brand networks.

Madden noted that GSI was the first hosting facility in the United States to be recognized as meeting Visa Inc.'s Cardholder Information Security Program security standards for managed hosting and co-location hosting.

A well-oiled machine

GSI does not sell its products and services through the ISO and MLS channel. Rather, it works in partnership with ISOs and MLSs to help merchants and processors achieve and preserve PCI compliance. It does not compete with ISOs.

"We don't displace their business," Madden said. "We are their IT department."

Many ISOs and MLSs have their own payment applications, which must be PCI-compliant.

However, they are also busy assisting their merchant customers with all aspects of card processing services, including PCI compliance.

GSI has 72 associates – 60 are technology professionals – who are ready to handle PCI DSS issues from three separate data centers in Kansas City, Mo. GSI monitors systems and software 24/7 and provides detailed and complete analysis of that information.

"We are ensuring that they pass audits and are compliant," Madden said. "Most hosting companies aren't going to say that." Madden also believes initial compliance for merchants can bring complacency, and the need for vigilance in maintaining PCI DSS standards is more critical now than ever before. "Our service ensures them [ISOs and merchants] that we are living compliance every day."

Partnerships with GSI can also eliminate the need for ISOs to replace existing payment application hardware or software. "If a processor already has their own application, we can work with them and make sure what they have is compliant," Madden said.

In addition, customers can consult GSI before installing new computer applications or making changes to e-commerce sites. GSI can advise businesses how to adjust operations for new business processes and demands and help them update or improve existing systems. "Some want to refresh, or they are getting something bigger and better," Madden said.

PCI compliance is a burden for companies – with or without IT staffs. Budgets are often stretched to capacity. They must meet the requirements or risk hefty fines or even the demise of their businesses.

GSI takes on a large portion of its clients' PCI responsibilities and relishes its ability to alleviate the myriad problems that can arise from noncompliance.