Advice re network compromise and "law enforcement" (PCI certification)

Hi all, I figure there's probably some folks on the list that have hands in
environments that touch credit cards. Unlike HIPAA compliance, or even
social security numbers, PCI is very ambiguous about what must occur if a
network/systems breach occurs that exposes credit card data. PCI, and its
auditors, don't seem to want to tell you what your security policy should
state with regard to what constitutes an event worthy of 'law enforcement'
contact, nor what agency is appropriate, yet they require you to have such
a policy in place.

Anyone have pointers/advice on what you came up with for a reasonable
definition of events that warrant involving law enforcement, and then what
agency/agencies would be contacted? We're obviously not going to waste the
time, on either side, of calling the FBI if one credit card number is
stolen since they won't care, nor would the local police, who don't even
have a cybercrime section.

Generic policies covering network breaches and law enforcement would be
welcome too; may be able to work it into something that is appropriate for
our environment and credit card data.



This question is best answered by an attorney with expertise in this area
and with specific knowledge of your operation.


Adding to what Rich said, it's very easy for advice on this to cross into
advice on legal matters.

It's also usually very illegal for non-attorneys or non-licensed attorneys
to offer advice on legal matters.

I recommend finding a lawyer with expertise in this area and who has
specific knowledge of your operation.

Matt Freitag
Network Engineer I
Information Technology
Michigan Technological University
(906) 487-3696 <%28906%29%20487-3696>

What advice does your QSA have regarding writing the policy?

There are generic templates available to write your company security policy. That policy doesn’t necessarily constitute legal definitions or requirements for any sort of breach, which may vary by locale and provider. I’m assuming EDUs will have their own set of rules as may non-profits.

At best you will want to pass legal responsibility out of technical hands into C-Level/management hands to make decisions about whom is notified, what legal actions and third parties are called in. Your security policy can define when the buck is passed and left to a given committee.

I am not a lawyer, and this is not legal advice, but...

General rule is to always notify the credit card companies, and to notify
legal. One/both/neither may advice law enforcement activity. In either
case, your PCI-required Incident response plan is required to do certain
isolation steps explicitly to aid in digitial forensics if an investigation
is needed. As for how many - thats a legal question, but under California
breach laws, any breach must notify the affected person(s), and over 500
has additional requirements - and those numbers do provide a sane precedent
to fall back to.

Also, reporting to an FBI office is a good move to provide a liability
shield to your company, as you did follow due diligence. If the FBI does
not follow up, thats not your problem.