Page 28 - gs260902

Cover Story continued

Our jobs become more difficult Assessors (QSAs).

when technologies don't talk to "That experience shaped what I wanted to build: a focused

each other. PCI DSS tool that simplified the work and provided the
freedom to work with a preferred QSA without vendor
lock-in," he said, noting he wasn't the only one needing
this tool. He credits colleagues whose valuable feedback
tasks. The self-described "reseller's reseller" resolved to do helped Oneiric make an internal tool into a viable product
something about it. that others could use.

"I've run an ISO long enough to know the feeling of being Oneiric's Which SAQ am I? tool attracted dozens of users
buried alive by your own reseller relationships," he said. the first week the website went live, Povreslo stated,
"We're not just plugged into one processor; we're resellers encouraging his team to fully automate the user-friendly
of transactions, equipment, SaaS technology, gateways, self-assessment questionnaire. Now merchants can type
ancillary services, you name it, and there was nothing on their answers into a plainly written, downloadable PDF
the market built to hold all of that together." and submit the form directly to their bank or acquirer.

As their existing CRM approached obsolescence, he and The PCI DSS Dashboard remains a work in progress,
Emily Karawadra, partner and chief operating officer he added, as feedback from people using the product
of the Impact family of brands, searched for suitable prompts requests for more features and helps shape the
replacements. "We tried the big-name CRMs everyone next iterations. Oneiric continues to map the entire PCI
recommends and bolted on financial tracking, equipment DSS standard to its database while adding new ideas and
deployment and agent commissions, hitting the same wall capabilities.
with CRMs built for different businesses," he said, adding
that logins were out of control. For us, by us
Shepherd, Karawadra and Povreslo shared how their
"When a client called in, I'd toggle through a graveyard solutions can improve efficiencies and benefit industry
of tabs trying to remember which portal had the answer," stakeholders.
he said. "Each deal required a different login and each
application meant keying the same merchant information • Pocket rocket: Shepherd observed that most MLSs
into the reseller's portal, our CRM and our billing want to see their projected margins and residuals. ISO
department. Train a new hire on that and watch them quit Amp's slider tool enables an MLS to price a deal, view
by Friday." potential earnings, adjust the merchant's pricing and
spark a conversation.
Building ISOhub was a game changer for the Impact
family of brands, Karawadra stated, noting the system "We can show a merchant a little proposal screen that
helped Impact PaySystem win back 130 hours of manual says, 'Hey, it looks like I might be able to save you up
entry in its first month of production. "Now I can run my to $300 a month. Can you grab a payment processing
entire ISO from a laptop, on a plane or on a beach," he said. statement so I can take a look at it and make sure this
"Wherever I am, the business is right there with me."
is accurate?'"
Out-of-reach to accessible compliance
ISO Amp continues to evolve, Shepherd noted, as client
Josip Povreslo, CEO of Field39 and Oneiric IT, found needs and market trends change. Amid ever-present
PCI DSS compliance cumbersome. Organizing policies, changes in statement terminology and card brand
procedures and evidence, then mapping everything to the rules, ISO Amp continuously updates its platform and
right requirements can be challenging, he stated, even for interchange optimization capabilities.
an experienced paytech.
"The three big iterations were automating data entry,
"Every year, certification meant rediscovering information, automating fee matching, and getting a statement
reorganizing documents, and repeating work that should done instantly if it passed all the quality checks," he
already be in one place," he said. "When your scope doesn't said.
change much from year to year, you're demonstrating
compliance against largely the same requirements, unless The biggest innovation by far, Shepherd stated, has
the standard itself changes." been using AI for the agent and ISO experience rather
than just on the back end. In fact, he mentioned that
Povreslo needed a specialized PCI DSS tool but found only ISO Amp's next release will use AI to extract key
enterprise-level governance, risk and compliance (GRC) talking points from each merchant statement analysis.
platforms. Solutions were either prohibitively expensive
or required him to work with their own Qualified Security • Both sides now: Karawadra pointed out that owning

28