Tim Thomas • Product Management, ControlScan

Tim Thomas oversees the product management function for ControlScan. Tim is focused on enhancing the company’s product and service deliverables to guide businesses through the complexity of the Payment Card Industry Data Security Standard (PCI DSS) as well as other security and privacy compliance processes.

Prior to joining ControlScan, Tim built and led technical support teams for TeleMate.Net software, a network monitoring and security solutions company, as well as ServiceCentral Software and CipherTrust, an email security and anti-spam software company that is now part of McAfee/Intel. Tim is a member of the PCI Security Standards Council’s SMB Task Force. He tweets at @tethomas_99.

Chris Bucolo • Director of Market Strategy, ControlScan

Chris Bucolo has over 30 years’ experience in the financial technology and payments industries. In his current role as Director of Market Strategy for ControlScan, Chris is responsible for enhancing the company’s payments industry partnerships by identifying and delivering data security and compliance solutions that maximize the relationship between merchant service providers and their customers. Previously he managed business development for the company’s security consulting and security engineering services.

Chris possesses a wealth of knowledge in payment security best practices and merchant relationships, having built and sold his own Independent Sales Organization (ISO), which was one of the first in the country to embrace Payment Card Industry (PCI) security standards and include related services among its core merchant offerings. He is a regular speaker at payments and security industry events, and his commentary has appeared in several notable publications as well as AP stories and live television interviews.

“Can We Securely Store Card Data for Recurring Billing?”

August 8, 2014 • Published by Brad Chronister PCI 101Data Storage, Penetration Testing, Recurring Billing, Recurring Payments, Requirement 9, Vulnerability Scanning

Should your business store cardholder data? While the PCI DSS discourages businesses from storing credit card data, many feel the practice is necessary in order to facilitate recurring payments.Here are a few of the related questions we’ve recently received: Question: We store credit card info (number … Read more

“How Does Taking Credit Cards by Phone Work with PCI?”

June 19, 2014 • Published by Brad Chronister PCI 101Hand Keying, Mail Order, MOTO, Phone Orders, Telephone Order, Virtual Terminal

Many business owners have asked us how to accept credit card information over the phone in a PCI compliant manner. Some have even assumed that because there’s a human involved the activity must be non-compliant. The good news is that you can take credit cards … Read more

IE Vulnerability: Crisis Averted for Windows XP Users?

May 2, 2014 • Published by Brad Chronister Best PracticesHIPAA, Internet Explorer, Microsoft, PCI Risk, Windows XP

Windows XP users may be breathing a sigh of relief following Microsoft’s announcement that it is patching—even for XP users—a major vulnerability discovered in its popular Internet Explorer (IE) browser. But folks, we’re just getting started. Now that the April 8 end date for Microsoft … Read more

“Is it OK to email inactive credit card numbers?”

May 1, 2014 • Published by Brad Chronister PCI 101Card brands, Closed accounts, Council, Email, Inactive cards, PAN

Question: Is a card that has been closed by an issuer that is no longer active still subject to the same compliance standards as an active card when looking to email a card number in the clear? Answer: First, I would recommend to NEVER email a credit card … Read more

“We submitted the wrong SAQ. Now what?”

April 23, 2014 • Published by Brad Chronister PCI 101Acquirers, ISOs, QSA, SAQ

Question: Are there any self-disclosure requirements based on inaccurate SAQ submissions? For example, if the incorrect SAQ was completed, what steps should be taken to complete the correct SAQ and how long would a company have to resubmit? Answer: This would all come down to … Read more

“We would like to request a credit card number in advance of an event…”

April 17, 2014 • Published by Brad Chronister Best PracticesCardholder Data, CHD, Data Storage, Encryption, Hardcopy Storage, Hospitality, PAN, Requirement 9, Sensitive Authentication Data, Tokenization

Question: We are developing our payment policy for a venue rental business and would like to request a credit card number to be submitted 14 days prior to the event to have on file for any damages that might occur during the event. Will I be … Read more