Decisions And Dilemmas Finding The PCI-DSS Balance UK Contact Centre Survey Autumn 2016

Transcription

1 WHITE PAPER Security & Compliance Decisions And Dilemmas Finding The PCI-DSS Balance UK Contact Centre Survey Autumn 2016 T +44 (0) E info@trustcall.com W SECURITY & COMPLIANCE PEACE OF MIND.

2 Abstract An IPI Insights September 2016 survey of the UK contact centre industry suggests that whilst most organisations are addressing the issues of PCI-DSS, many have substantial implementation challenges ahead. The impact of potential PCI- DSS breaches on customer experience and the brand is seen as more important than potential sanctions. However the big concern with PCI-DSS solutions is identified as the cost and the complexity of the systems changes required. The survey reinforces the IP Integration opinion that the best approaches to PCI-DSS need to be pragmatic, flexible and always focused on the customer journey and expectations. In addition, the technical, commercial, budgeting and organisational challenges of PCI- DSS mean it is wise for that journey not to be taken alone. This survey suggests that the best solutions require high degrees of collaboration both within the organisation and across its roster of advisers, consultants and vendor partners. For most who have started on the PCI-DSS journey, the primary issues to address are staff training and call recording rather than extensive plans for clean room solutions (which may impact negatively on agent job satisfaction and customer service).

3 INTRODUCTION Finding the Balance It seems crazy that only a few years ago our whole economy was nearly brought to its knees by the decisions made by a handful of senior bankers. The collapse of banks like Northern Rock and other previously venerable institutions should be a lesson to us all a lesson in the value of customer confidence and brand loyalty. Although there is no dispute that the Bankers started the recession there is now evidence that the depth of the recession was more down to the dropping off in consumer spending than anything else. This at the Macroeconomic level was proof positive that customer confidence directly affects consumer spending. According to a recent study* over 68% of consumers believe that more should be done by UK businesses to reduce the chances of customers being affected by card fraud. In addition, 80% of consumers identified that they thought that call centres were an area of an organisation that is potentially vulnerable, with only 14% feeling confident that the businesses they buy from have adequate security standards to ensure confidential information is kept private. PCI compliance in the Contact Centre is required to close this gap. Can you afford to have your Contact Centre standing out from the competition because it hasn t adopted PCI compliance? Focus on The Customer With the above in mind it is not surprising that in our survey over 70% of respondents cited Brand Reputation and Improving Customer Trust, Satisfaction and Experience as the main motivators for addressing PCI compliance. The Contact Centre and Compliance practitioners surveyed clearly understand the link between the trust of their clients and revenue. In a globally competitive, media driven world, an unexpected fall in customer confidence can have a very immediate and possibly terminal impact on revenue and profit. This is the risk that you are taking by not addressing PCI compliance in your Contact Centres. Time is of the essence because consumers increasingly know that they have choice and can act emotionally in large numbers, driven by activist campaigning. Is it the time to be risking this critical relationship by not having adopted the right PCI compliance solutions in your Contact Centre? * Keynote Market Assessment, Contact Centre, 9th Edition, 2013, Ed. Robert Hucker the best approaches to PCI-DSS need to be pragmatic, flexible and always focused on the customer journey. ~ Neil Boxer, CTO

4 Do I Really Need PCI? It seems crazy that only a few years ago our whole economy was nearly brought to its knees by the decisions made by a handful of senior bankers. The collapse of banks like Northern Rock and other previously venerable institutions should be a lesson to us all a lesson in the value of customer confidence and brand loyalty. Although there is no dispute that the Bankers started the recession there is now evidence that the depth of the recession was more down to the dropping off in consumer spending than anything else. This at the Macroeconomic level was proof positive that customer confidence directly affects consumer spending. According to a recent study* over 68% of consumers believe that more should be done by UK businesses to reduce the chances of customers being affected by card fraud. In addition, 80% of consumers identified that they thought that call centres were an area of an organisation that is potentially vulnerable, with only 14% feeling confident that the businesses they buy from have adequate security standards to ensure confidential information is kept private. PCI compliance in the Contact Centre is required to close this gap. Can you afford to have your Contact Centre standing out from the competition because it hasn t adopted PCI compliance?

5 KEY FINDINGS A Journey Best Not Taken Alone Seeking to understand more about the state of PCI-DSS readiness and approaches, the IPI Insights Team commissioned Cremarc to conduct a survey in September 2016 to investigate the status of PCI-DSS compliance within the UK contact centre industry. The survey respondents worked across sectors, with the most working within Public Sector (26%), Financial Services (21%) and Retail (8%). The most common Telephony Platform used by respondents was Avaya (36%), Cisco (19%) and Mitel (16%). For IVR platform was Avaya (29%), Cisco (22%) and Mitel (15%).For Call Recording, the mix was Avaya (20%), Verint (16%) and Redbox (12%). Who Owns The Problem? Whilst over 98% of respondents noted that PCI-DSS is a business issue owned by a key individual, the location of that responsibility differed. Whilst 49% identified that PCI-DSS sat within a centralised compliance function, responsibility in other organisations was held in the Contact Centre (13 %) or Operations (11 %), or in departments such as Auditing, Legal, Strategy or Finance. The wide variation in responses regarding the potential fines and the number of agents prosecuted reflects the fact that the PCI-DSS topic is one where there is still a lack of clarity and a high degree of uncertainty. Whereas 54% believed that more than twenty businesses had been in breach of PCI-DSS compliance in 2013, 25% thought it was between 6-20 and 20% thought it was less than five. When asked about how many agents were prosecuted in 2013, the survey responses were again spread almost evenly across the ranges from none (23%), less than five (21%), less than 20 (24%) to more than 20 (32%). A Lack of Consensus The variation in responses suggests a lack of consensus on the likely risks. When we asked respondents to suggest how much should be budgeted to train agents in PCI-DSS, the figures ranged from 1000 to 20,000 per agent, with no real definitive standard. These results show that every organisation needs to approach PCI-DSS as objectively as possible and take into account their own specific needs, risks and commercial position. be as objective as possible and take into account your own specific needs ~ Dave Glasgow, Director Note: The 2016 survey serves only as a simple barometer of current industry opinion and this ebook should not be relied upon to make IT or networking or PCI-DSS decisions. Each PCI-DSS solution requires bespoke scoping and implementation in accordance with its own business demands and priorities. To find out more about creating a roadmap for PCI-DSS project please contact IP Integration.

6 KEY FINDINGS ONE: CONFIDENCE WHEN YOU USE A PAYMENT CARD HOW CONFIDENT ARE YOU THAT YOUR DETAILS ARE MANAGED COMPLIANTLY? 74% Reasonably Confident 26% Not very/not at all Complacent or Confident? Nearly three quarters of industry personnel who completed the survey expressed a high degree of confidence that their colleagues are handling their card details responsibly. Against a backdrop of a lot less than 74% of Contact Centres having fully complied, this would appear to suggest that for many in the industry, there is either a degree of complacency OR an understanding that in the vast majority of cases, Contact Centres are managing card details responsibly. SECURITY & COMPLIANCE PEACE OF MIND.

7 KEY FINDINGS TWO: MOTIVATION WHAT IS THE MAIN MOTIVATION FOR ADDRESSING PCI COMPLIANCE IN YOUR ORGANISATION? 40% avoiding damage to brand reputation 31% improving customer trust 21% fines and penalties What Does This Mean? For most respondents, the issue of PCI-DSS is not purely about technology, or even about the risk of fines and penalties but rather the impact of any PCI weakness or transgression on brand reputation and customer trust. This is a critical point that reflects the priorities of contact centre professionals approaching PCI-DSS. The customer journey, the way in which their information and transaction are handled and the reassurance that the brand is one to be trusted are vital objectives for any PCI-DSS project.

8 KEY FINDINGS THREE: NEGATIVE IMPACTS WHAT NEGATIVE IMPACTS CAN PCI-DSS COMPLIANCE HAVE 72% Costly and complex system changes 50% Negative customer experience Eliminate the Negatives Once again, concern was expressed about the potential negative impact of PCI-DSS compliance solutions on the Customer Experience. Delays in transactions, confusing processes and a lack of explanations could substantially impact on the customer experience and could be damaging commercially. However, the costs and resource consumed with systems changes was clearly the biggest concern of respondents. Projects must be carefully scoped according to needs, time and budget and this is where consultants, vendors and clients need to be realistic and proactive in building initiatives that can deliver in full, on time, to the right specification and within a realistic budget.

9 KEY FINDINGS FOUR: COMPLIANCE STATUS WHICH OF THE FOLLOWING BEST DESCRIBES YOUR CONTACT CENTRE S PCI-DSS COMPLIANCE STATUS 36% Fully implemented. Now in on-going audit and review Compliance in progress Implementation substantially complete but some loose ends to be tidied up 34% 16% We are at the start of the journey Compliance programme commenced. Planning largely complete but some implementation strands yet to be started 14% Where Are You on the Journey? More than 2/3 have either implemented or are on their way to implementing, with remaining 1/3 either at the start of their PCI-DSS journey or partly implemented. IPI s own work in this area suggests that planning and approval of solutions and roadmaps can help set the right direction (and forms a large part of the complete project). The implementation, however, is often the source of speed bumps and road blocks on the way, as changes to systems, training and processes start to be rolled out through an organisation. Again, building the right collaborative relationships both within the organisation and with suppliers, enables greater degrees of success. SECURITY & COMPLIANCE PEACE OF MIND.

10 KEY FINDINGS FIVE: ACTIONS TAKEN WHAT ACTIONS HAVE YOU TAKEN TO ADDRESS PCI-DSS COMPLIANCE? 93% Call centre agents trained 85% Call recording updated 54% Clean Room Implemented 58% Automated Payment Collection Be Pragmatic For most respondents, the PCI-DSS project priorities are contact centre agent training and call recording updates. Clean room approaches are either being perhaps worked on or not preferred within the business. This reflects the experience of IPI, where we have seen many companies wary of implementing complete clean room approaches which are often seen as potentially complex. They are seen as damaging for agent job satisfaction and pose risks for customer service and ultimately satisfaction and loyalty. SECURITY & COMPLIANCE PEACE OF MIND.

11 KEY FINDINGS SIX: OWNERSHIP WHO OWNS PCI-DSS IN YOUR ORGANISATION AND WHERE DO THEY SIT? Compliance 49% Contact Centre Other 21% 14% Operations 11% Internal Audit Legal 3.5% 1.5% Who Should Own It? Whilst over 87% of respondents stated that PCI-DSS had a designated owner within the organisation, the point of ownership varies. Whilst a centralised Compliance Department was cited most frequently, this was still less than 50% of organisations. In others, the responsibility was held by a range of different experts and specialisms; from Contact Centre, Operations & Legal to Auditing, Finance or ecommerce. With PCI-DSS potentially touching on so many different areas in the organisation, it is important that whoever has responsibility for it communicates and collaborates with key colleagues - as any programme is likely to impact across broader processes and systems.

12 CONCLUSIONS Pragmatism and Partnerships Our survey showed that over two thirds of the market is yet to implement a compliance solution, which actually seems low compared to our experience. Even so, this means there are a huge number of organisations that will be going to market to implement a solution. Given that this is not a short process, it would be wise to start to get serious about it now. Leave it too late and the chance of finding the right solution partner with bandwidth to help in a narrow window will diminish. Pragmatic Approach Given the potential rush to the same side of the ship, the pragmatic solution to the challenges of PCI compliance seems like the best route to take. The two areas where most respondees had already started work were cited as Call Recording updated and Agents Trained ; the two most pragmatic solutions. The more challenging areas of Clean Rooms and Automated Payments both were less well adopted because they have so much more of an impact in terms of the end user and agent experience. So it is clear that where solutions to PCI can be found that do not either disrupt the customer experience, or make pariahs of your agents (and affect their motivation), these are the solutions to focus on. The Right Partner So if you accept the need to do something about PCI, soon and in a pragmatic way, what else are you missing? The key ingredient - the right people to work with. The challenge is not inconsiderable here. Firstly, there are often a number of stakeholders in your business: compliance officers, IT staff, and Contact Centre management. In addition you may need to employ an external Consultant (Quality Security Assessor) to ensure your Contact Centre is compliant. With this number of stakeholders to manage it is quite likely that a one size fits all approach is not going to work. solutions must not disrupt the customer experience or make pariahs of your agents ~ Steve Murray Business Development Director

13 There are a number of key criteria that you need to consider when selecting your PCI technology partner: 1. What s their engagement model? Are they collaborative and will they be able to help get consensus agreed across the stakeholder group. 2. Do they offer choice in terms of the sort of solutions they can provide? It is only some way into the project that it will become clear what solution will work best for your business so ensure you engage a technology partner that can provide flexibility. 3. Does their solution look to provide a compromise between the key stakeholders? If the solution being proposed alienates one set of stakeholders then the chances are that the project is less likely to have a positive outcome. 4. Does it disrupt the customer journey? Most Contact Centres have spent a lot of their budget ensuring that the customer experience is the best it can be. A good PCI compliance solution should not disrupt or interrupt this experience. 5. Does it work for agents? Agents sometimes get lost in the decision making mix. Their buy in to any new solution is essential to maintaining market leading customer service. 6. Is the supplier referencable? Have they supplied similar solutions to similar businesses? Resources Industry links UK Cards Association The UK Cards Association 2 Thomas More Square London E1W 1YN Tel: Web: PCI Standards Council PCI Security Standards Council, LLC 401 Edgewater Place Suite 600 Wakefield, MA USA Web: UK Card Scheme Providers American Express - www209.americanexpress.com/merchant/marketing-data-intl/emea/en_gb/merchant/home Mastercard - Diners Club - Visa - retailers/payment_security.aspx Barclaycard - Additional Research and Information PCI Security Standards 10 Common Myths - PCI Standards Glossary of Terms - PCI DSS compliance questions: Deadlines, fines, tiers, costs Published by Computerweekly.com, 10th January

14 CHANGE TODAY AND YOU CHANGE TOMORROW The way we communicate continues to change at pace. Tomorrow has never looked so different from today. IPI is here to keep your business in touch with its customers. With innovation in our DNA, we deploy pioneering solutions to help create the smartest, most efficient Contact Centres in the world. Optimised hubs that offer a more satisfying, more cost-effective customer experience. And just as our offering is complete, so too is our support. Helping you to not just prepare for what s to come, but to embrace it. Our team of experts understands the technical, commercial and organisational challenges contact centres face and offers a wide range of solutions that help organisations overcome them to increase effectiveness, efficiency and customer satisfaction. Our customers range in size from 30 to 10,000 seats, such is the flexibility and scalability of our solutions, and are split across many vertical markets including finance, insurance, retail and distribution, public sector, transport and travel, and entertainment and leisure. In addition, IP Integration meets BSI standards in Quality Management, Environmental Management and Information Security Management. Headquartered in Reading, and with offices in Manchester and Edinburgh, IP Integration is a leading independent contact centre systems integrator. We partner with many leading vendors, including Avaya, Verint, Microsoft and VMware. We also develop in-house bespoke applications that support end-to-end contact centre deployments, from network service provision, through systems design and deployment, to application development and postimplementation service and support. Change your tomorrow, today. Get in touch. T +44 (0) E info@trustcall.com W SECURITY & COMPLIANCE PEACE OF MIND.