• DALLAS 

The Army & Air Force Exchange Service (AAFES) successfully completed its Payment Card Industry (PCI) assessment, earning a clean Report on Compliance (RoC) with no compensating controls for the 15th year in a row.   

PAYMENT CARD INDUSTRY (PCI) 

The Payment Card Industry (PCI) is a global network that enables secure electronic payments using credit, debit or prepaid cards.  

To maintain security across this ecosystem, the industry established the PCI Data Security Standard (PCI DSS), which sets the benchmark for protecting cardholder data.  

This is especially important for Exchange shoppers, including Military Star Card members. 

PCI ASSESSMENT 

“A PCI assessment involves an independent review of our systems, processes and environment by a Qualified Security Assessor (QSA),” said Exchange Information Technology (IT) Policy and Planning Manager Tom Giangreco II.  

“The QSA tests controls, conducts interviews, reviews documentation and gathers evidence,” he explained. “The assessment is specifically focused on protecting payment card data and is governed by the PCI Security Standards Council.”  

Before the formal assessment, a pre-assessment is conducted to identify a location that is well-prepared and capable of demonstrating compliance.  

This year, the Fort Carson, Colo., Exchange was selected. It had not been previously assessed, and its diverse operations made it an ideal location. 

SHARED RESPONSIBILITY 

PCI compliance is a shared responsibility. A cross-functional team drives the effort, including Store Operations, IT, Loss Prevention and Facilities Maintenance Office (FMO).  

Field leadership and frontline associates also play a critical role, because protecting cardholder data is everyone’s responsibility. 

Exchange Vice President (VP) and Chief Information Security Officer David Adams credited Exchange teams here at headquarters and in Colorado for their roles in the successful assessment, singling out Giangreco, Information Assurance Program Manager David Cline, Exchange Business Analyst Helen Boyce and IT Policy and Risk Specialist Russ Marshall for their early and thorough preparation, which ensured a smooth and timely evaluation. 

REPORT ON COMPLIANCE (RoC) 

A Report on Compliance (RoC) is a formal document completed by a qualified security assessor that summarizes the results of the PCI DSS assessment.  

It is required for merchants and service providers, like the Exchange, that process more than 6 million card transactions annually. 

If a company cannot meet a specific PCI DSS requirement because of technical or business constraints, it must implement compensating controls. This means that an alternative security measure is suggested to provide equivalent protection.  

For example, if an organization cannot install a firewall because of budget limitations, it must deploy multiple-layered security measures to achieve the same level of defense. 

When the Exchange receives a clean RoC with no compensating controls, it means every requirement was met directly and without exception — which is a clear indicator of operational excellence and security leadership.  

PCI IMPACT ON IN-STORE, ONLINE PAYMENTS 

“The PCI standards influence every aspect of operations, from securing point-of-sale (POS) systems to encrypting and transmitting payment data and even training team members,” Adams said.  

“In stores, this means deploying tamper-resistant terminals and ensuring card data is never stored,” he explained. “Online, it involves secure platforms, tokenization and continuous threat monitoring.  

“Across all channels, strict and thoroughly tested procedures are followed to protect cardholder information.” 

Source: AAFES 

Edited by Larry Lapka