Merchants/Retailers Face Increased Information Risk

Credit Cards

Accepting credit or debit transactions places the merchant under an obligation to safeguard these transactions. Merchants and Retailers have been the victim of a number of very high profile data breaches involving theft of credit card information.

Today’s headline news says it all: Albert Gonzalez, who operated under the hacker alias SoupNazi, pleaded guilty last year to slipping into the computer networks of major retailers such as TJ Maxx, BJ's Wholesale Club, Barnes & Noble, OfficeMax and Boston Market. – ABCNews

Compliance with the Payment Card Industry self-regulated standards (PCI DSS) is now required for all businesses who accept credit cards regardless of transaction volume. Non-compliance results in penalties from the Credit Card brands as well as increased tranasction fees. But these costs are only the beginning of your business liability. A merchant faces possible State and Federal enforcement of FTC laws should it be found that reasonable care was not exercised in protecting customer information. Perhaps most impactful of all isthe resulting negative media publicity stemming from a credit card data breach, damaging the public’s trust of your business resulting in a loss of sales and reputation.

But compliance alone is not enough . . .
to safeguard your business from the risk of a credit card data beach.  Many retailers who have been breached were assessed to be compliant.  Since it can be easily monetized, credit card information is very attractive to criminals who will always be one step ahead of any standards.  An in-depth risk assessment of your entire credit card environment is also needed to identify other vulnerabilities which may exist to this threat in your unique environment .  As a case in point, recent credit card data breaches have taken place through the use of sniffer malware which captured credit card transactions “in flight”.  Encryption of transactions would have mitigated this risk.  For more information on how Assurance Point can help assess risk, see our Services page

Operational Risk from a Disaster Event

The operations of today’s retailers are very dependent on sophisticated Supply Chain systems which enable timely and efficient ordering, warehousing and shipment of products. Should an organization's Supply Chain processes not be available, even for a short time, the financial impact can be large due to lost sales and operational disruption. To reduce the liability of Supply Chain failure, an organization should have a Business Continuity Plan in place. Assurance Point can help your business put a continuity plan in place using the following Framework:

Perform an Impact Analysis
This determines the business loss from a process failure and prioritizes systems for recovery.

Develop a Recovery Strategy
A recovery approach is planned based on recovery time and recovery point objectives.

Create a Sustainable Recovery Plan
Together with IT, each business function creates an action plan to enable it to manage a disaster event and execute its strategy to continue operations with minimal impact.