What are drop test standards
Links related to "what are drop test standards"
Public Sector Devices
Switch to the network America relies on and get a $100 Bill Credit!,Keep your organization connected, securely. Get exclusive offers on public sector devices,on America's most reliable 5G network. Free for new lines & upgrades. Limited time only! Ends June30. Free for new lines & upgrades. Stay securely connected for greater efficiency and productivity. For new lines and upgrades,Galaxy S23 FE is jam-packed with features including a long-lasting battery, a premium processor, a smooth and strong display, a triple-lens camera and more. Capture incredible detail with a 48MP Main camera. Experience iPhone in a whole new way with Dynamic Island and Always-On, on the beautifully sized 6.1-inch display. And get peace of mind with groundbreaking safety features. Capture incredible detail with a 48MP Main camera. Experience iPhone in a whole new way with Dynamic Island and Always-On display, on the beautifully sized 6.7-inch display. And get peace of mind with groundbreaking safety features. Think big with a larger 6.7-inch display and all-day battery life. Capture stunning photos in low light and bright light with the new dual-camera system. Get peace of mind with groundbreaking safety features. Remarkable battery life. Emergency SOS via satellite. Crash Detection calls for help when you can't. Get an advanced dual-camera system. Lightning-fast A15 Bionic chip. A big leap in battery life. Durable design. Superfast 5G. And a brighter Super Retina XDR display. iPhone SE. With the power iPad has the powerful A13 Bionic chip, all-day battery life,a beautiful 10.2-inch Retina display, an Ultra Wide from camera with Center Stage, and works with Apple Pencil and Smart Keyboard. With Google Tensor G3 and the certified Titan M2 security chip, Pixel is built with multiple layers of security to help keep your personal info safe.* Plus, Pixel will receive the latest OS and security updates for 7 years.** With the immersive 6.7-inch display you can draft emails, input data and read documents with ease.* With Google Tensor G3 and the certified Titan M2 security chip, Pixel is built with multiple layers of security to help keep your personal info safe.** Plus, Pixel will receive the latest OS and security updates for 7 years.*** Engineered by Google, the Pixel 7a is priced right for your organization's budget. The Pixel 7a provides Google's top of the line productivity and security features. The Google Pixel 7, with a 6.3 display, Google Tensor G2, and Titan M2 security chip to help keep information secure. Mobile Broadband or M2M plan of $19.99 or higher. The mobile hotspot that delivers a next level, virtually lag-free connected experience powered by Verizon 5G and Wi-Fi 6 for up to 32 Wi-Fi-enabled devices, including laptops and tablets. With its solid performance, reliable experience, and enhanced security features, DuraForce PRO 3 offers enterprise-level durability and functionality to help keep teams connected wherever they are. Compact and portable, plus with long-lasting battery life, you can take the DuraXV Extreme+ with you on the go and support up to 10 devices on the built-in mobile hotspot. Large 6.1 Glove & Wet Touch capable, scratch resistant FHD+ display, a programmable PTT button and MIL-STD-810H tested for a phone you can rely on. Lightweight, rugged, and IP68 certified to be washable and easily sanitized. TAA compliant. MCPTT supported. With Verizon 4G LTE, free yourself from Wifi and stay productive where your business and the classroom take you. Samsung Galaxy Chromebook® Go is solidly built to endure everyday bumps and bruises, and its battery can power through the day without needing to sit by a power outlet. Awesome belongs to your organization with Galaxy A15 5G. Built with all the essential features, Galaxy A15 5G makes it easier to embrace cutting-edge innovation while providing exceptional value. Meet the new Galaxy Tab A9+ 5G, your all-in-one tablet for all your organization's needs. Make every workday epic with the Galaxy S24. From researching case studies online to capturing stunning pics for your web content, do more easily with the Galaxy S24, just like that. With 2-year/1-year agreement,Powerful performance with defense-grade security. Keep your data safe with Knox multilayered security, including protection from the chip to the cloud. Get powerful performance with reliable Verizon 5G, built-in Knox Security for defense-grade protection and a long lasting battery. Plus, a versatile hi-res camera and the power to collaborate with Microsoft and Google integrations. MIL-STD-810H & 1.5m drop tested. IP68 rated to stand up to dust, dirt, sand and water. Defense-grade security with Samsung Knox helps keep your data secure. Programmable keys for push-to-talk. Long lasting replaceable battery. Make every workday more productive with Galaxy Tab S9 FE Wi-Fi, featuring a powerful processor, a long-lasting battery and a dynamic 10.9 screen* to help you stay on top of your goals. Rugged Design is built to industry-leading Rugged Performance Standards, including MIL-STD-810H31 and Non-Incendive Class I, II, and III Div 2 ratings. Ultra-rugged and has a new 2.8 dynamic screen with programmable buttons to tailor your device to how you work. A strong multi-shift battery and large, glove-friendly keypad. Large 16GB storage. Meet the TCL LINKZONE 5G UW. The super-fast and efficient mobile hotspot that allows you to create your own secure Wi-Fi network so you can work, play, and stream on the go. Keep your organization securely connected, even in the most demanding situations, with durable smartphones that can withstand extreme environments. MIL-STD-810H & 1.5m drop tested. IP68 rated to stand up to dust, dirt, sand and water. Defense-grade security with Samsung Knox helps keep your data secure. Programmable keys for push-to-talk. Long lasting replaceable battery. With its solid performance, reliable experience, and enhanced security features, DuraForce PRO 3 offers enterprise-level durability and functionality to help keep teams connected wherever they are. Large 6.1 Glove & Wet Touch capable, scratch resistant FHD+ display, a programmable PTT button and MIL-STD-810H tested for a phone you can rely on. Lightweight, rugged, and IP68 certified to be washable and easily sanitized. TAA compliant. MCPTT supported. Compact and portable, plus with long-lasting battery life, you can take the DuraXV Extreme+ with you on the go and support up to 10 devices on the built-in mobile hotspot. Rugged Design is built to industry-leading Rugged Performance Standards, including MIL-STD-810H31 and Non-Incendive Class I, II, and III Div 2 ratings. Ultra-rugged and has a new 2.8 dynamic screen with programmable buttons to tailor your device to how you work. A strong multi-shift battery and large, glove-friendly keypad. Large 16GB storage. The advanced network for first responders on the front lines. For new lines and upgrades,Galaxy S23 FE is jam-packed with features including a long-lasting battery, a premium processor, a smooth and strong display, a triple-lens camera and more. ,iPhone SE. With the power Engineered by Google, the Pixel 7a is priced right for your organization's budget. The Pixel 7a provides Google's top of the line productivity and security features. Mobile Broadband or M2M plan of $19.99 or higher. The mobile hotspot that delivers a next level, virtually lag-free connected experience powered by Verizon 5G and Wi-Fi 6 for up to 32 Wi-Fi-enabled devices, including laptops and tablets. With its solid performance, reliable experience, and enhanced security features, DuraForce PRO 3 offers enterprise-level durability and functionality to help keep teams connected wherever they are. Large 6.1 Glove & Wet Touch capable, scratch resistant FHD+ display, a programmable PTT button and MIL-STD-810H tested for a phone you can rely on. Lightweight, rugged, and IP68 certified to be washable and easily sanitized. TAA compliant. MCPTT supported. Compact and portable, plus with long-lasting battery life, you can take the DuraXV Extreme+ with you on the go and support up to 10 devices on the built-in mobile hotspot. Awesome belongs to your organization with Galaxy A15 5G. Built with all the essential features, Galaxy A15 5G makes it easier to embrace cutting-edge innovation while providing exceptional value. Meet the new Galaxy Tab A9+ 5G, your all-in-one tablet for all your organization's needs. Make every workday epic with the Galaxy S24. From researching case studies online to capturing stunning pics for your web content, do more easily with the Galaxy S24, just like that. MIL-STD-810H & 1.5m drop tested. IP68 rated to stand up to dust, dirt, sand and water. Defense-grade security with Samsung Knox helps keep your data secure. Programmable keys for push-to-talk. Long lasting replaceable battery. For new lines and upgrades,Galaxy S23 FE is jam-packed with features including a long-lasting battery, a premium processor, a smooth and strong display, a triple-lens camera and more. iPad has the powerful A13 Bionic chip, all-day battery life,a beautiful 10.2-inch Retina display, an Ultra Wide from camera with Center Stage, and works with Apple Pencil and Smart Keyboard. With Verizon 4G LTE, free yourself from Wifi and stay productive where your business and the classroom take you. Samsung Galaxy Chromebook® Go is solidly built to endure everyday bumps and bruises, and its battery can power through the day without needing to sit by a power outlet. Think big with a larger 6.7-inch display and all-day battery life. Capture stunning photos in low light and bright light with the new dual-camera system. Get peace of mind with groundbreaking safety features. Remarkable battery life. Emergency SOS via satellite. Crash Detection calls for help when you can't. Get an advanced dual-camera system. Lightning-fast A15 Bionic chip. A big leap in battery life. Durable design. Superfast 5G. And a brighter Super Retina XDR display. iPhone SE. With the power Engineered by Google, the Pixel 7a is priced right for your organization's budget. The Pixel 7a provides Google's top of the line productivity and security features. The Google Pixel 7, with a 6.3 display, Google Tensor G2, and Titan M2 security chip to help keep information secure. Mobile Broadband or M2M plan of $19.99 or higher. The mobile hotspot that delivers a next level, virtually lag-free connected experience powered by Verizon 5G and Wi-Fi 6 for up to 32 Wi-Fi-enabled devices, including laptops and tablets. Large 6.1 Glove & Wet Touch capable, scratch resistant FHD+ display, a programmable PTT button and MIL-STD-810H tested for a phone you can rely on. Lightweight, rugged, and IP68 certified to be washable and easily sanitized. TAA compliant. MCPTT supported. Compact and portable, plus with long-lasting battery life, you can take the DuraXV Extreme+ with you on the go and support up to 10 devices on the built-in mobile hotspot. Get the Galaxy S23 FE as low as $0,For new lines and upgrades,Galaxy S23 FE is jam-packed with features including a long-lasting battery, a premium processor, a smooth and strong display, a triple-lens camera and more. With 2-year/1-year agreement,Powerful performance with defense-grade security. Keep your data safe with Knox multilayered security, including protection from the chip to the cloud. Get powerful performance with reliable Verizon 5G, built-in Knox Security for defense-grade protection and a long lasting battery. Plus, a versatile hi-res camera and the power to collaborate with Microsoft and Google integrations. With Verizon 4G LTE, free yourself from Wifi and stay productive where your business and the classroom take you. Samsung Galaxy Chromebook® Go is solidly built to endure everyday bumps and bruises, and its battery can power through the day without needing to sit by a power outlet. MIL-STD-810H & 1.5m drop tested. IP68 rated to stand up to dust, dirt, sand and water. Defense-grade security with Samsung Knox helps keep your data secure. Programmable keys for push-to-talk. Long lasting replaceable battery. Rugged Design is built to industry-leading Rugged Performance Standards, including MIL-STD-810H31 and Non-Incendive Class I, II, and III Div 2 ratings. Ultra-rugged and has a new 2.8 dynamic screen with programmable buttons to tailor your device to how you work. A strong multi-shift battery and large, glove-friendly keypad. Large 16GB storage. For new lines and upgrades,Galaxy S23 FE is jam-packed with features including a long-lasting battery, a premium processor, a smooth and strong display, a triple-lens camera and more. Think big with a larger 6.7-inch display and all-day battery life. Capture stunning photos in low light and bright light with the new dual-camera system. Get peace of mind with groundbreaking safety features. Remarkable battery life. Emergency SOS via satellite. Crash Detection calls for help when you can't. Get an advanced dual-camera system. Lightning-fast A15 Bionic chip. A big leap in battery life. Durable design. Superfast 5G. And a brighter Super Retina XDR display. iPhone SE. With the power With Google Tensor G3 and the certified Titan M2 security chip, Pixel is built with multiple layers of security to help keep your personal info safe.* Plus, Pixel will receive the latest OS and security updates for 7 years.** With the immersive 6.7-inch display you can draft emails, input data and read documents with ease.* With Google Tensor G3 and the certified Titan M2 security chip, Pixel is built with multiple layers of security to help keep your personal info safe.** Plus, Pixel will receive the latest OS and security updates for 7 years.*** Engineered by Google, the Pixel 7a is priced right for your organization's budget. The Pixel 7a provides Google's top of the line productivity and security features. The Google Pixel 7, with a 6.3 display, Google Tensor G2, and Titan M2 security chip to help keep information secure. Mobile Broadband or M2M plan of $19.99 or higher. The mobile hotspot that delivers a next level, virtually lag-free connected experience powered by Verizon 5G and Wi-Fi 6 for up to 32 Wi-Fi-enabled devices, including laptops and tablets. Large 6.1 Glove & Wet Touch capable, scratch resistant FHD+ display, a programmable PTT button and MIL-STD-810H tested for a phone you can rely on. Lightweight, rugged, and IP68 certified to be washable and easily sanitized. TAA compliant. MCPTT supported. Compact and portable, plus with long-lasting battery life, you can take the DuraXV Extreme+ with you on the go and support up to 10 devices on the built-in mobile hotspot. Awesome belongs to your organization with Galaxy A15 5G. Built with all the essential features, Galaxy A15 5G makes it easier to embrace cutting-edge innovation while providing exceptional value. Meet the new Galaxy Tab A9+ 5G, your all-in-one tablet for all your organization's needs. Make every workday epic with the Galaxy S24. From researching case studies online to capturing stunning pics for your web content, do more easily with the Galaxy S24, just like that. For new lines and upgrades,Galaxy S23 FE is jam-packed with features including a long-lasting battery, a premium processor, a smooth and strong display, a triple-lens camera and more. With 2-year/1-year agreement,Powerful performance with defense-grade security. Keep your data safe with Knox multilayered security, including protection from the chip to the cloud. MIL-STD-810H & 1.5m drop tested. IP68 rated to stand up to dust, dirt, sand and water. Defense-grade security with Samsung Knox helps keep your data secure. Programmable keys for push-to-talk. Long lasting replaceable battery. Get powerful performance with reliable Verizon 5G, built-in Knox Security for defense-grade protection and a long lasting battery. Plus, a versatile hi-res camera and the power to collaborate with Microsoft and Google integrations. Make every workday more productive with Galaxy Tab S9 FE Wi-Fi, featuring a powerful processor, a long-lasting battery and a dynamic 10.9 screen* to help you stay on top of your goals. Rugged Design is built to industry-leading Rugged Performance Standards, including MIL-STD-810H31 and Non-Incendive Class I, II, and III Div 2 ratings. Ultra-rugged and has a new 2.8 dynamic screen with programmable buttons to tailor your device to how you work. A strong multi-shift battery and large, glove-friendly keypad. Large 16GB storage. Meet the TCL LINKZONE 5G UW. The super-fast and efficient mobile hotspot that allows you to create your own secure Wi-Fi network so you can work, play, and stream on the go. For new lines and upgrades,Galaxy S23 FE is jam-packed with features including a long-lasting battery, a premium processor, a smooth and strong display, a triple-lens camera and more. Think big with a larger 6.7-inch display and all-day battery life. Capture stunning photos in low light and bright light with the new dual-camera system. Get peace of mind with groundbreaking safety features. Remarkable battery life. Emergency SOS via satellite. Crash Detection calls for help when you can't. Get an advanced dual-camera system. Lightning-fast A15 Bionic chip. A big leap in battery life. Durable design. Superfast 5G. And a brighter Super Retina XDR display. iPhone SE. With the power With Google Tensor G3 and the certified Titan M2 security chip, Pixel is built with multiple layers of security to help keep your personal info safe.* Plus, Pixel will receive the latest OS and security updates for 7 years.** With the immersive 6.7-inch display you can draft emails, input data and read documents with ease.* With Google Tensor G3 and the certified Titan M2 security chip, Pixel is built with multiple layers of security to help keep your personal info safe.** Plus, Pixel will receive the latest OS and security updates for 7 years.*** Engineered by Google, the Pixel 7a is priced right for your organization's budget. The Pixel 7a provides Google's top of the line productivity and security features. The Google Pixel 7, with a 6.3 display, Google Tensor G2, and Titan M2 security chip to help keep information secure. Mobile Broadband or M2M plan of $19.99 or higher. The mobile hotspot that delivers a next level, virtually lag-free connected experience powered by Verizon 5G and Wi-Fi 6 for up to 32 Wi-Fi-enabled devices, including laptops and tablets. Large 6.1 Glove & Wet Touch capable, scratch resistant FHD+ display, a programmable PTT button and MIL-STD-810H tested for a phone you can rely on. Lightweight, rugged, and IP68 certified to be washable and easily sanitized. TAA compliant. MCPTT supported. Compact and portable, plus with long-lasting battery life, you can take the DuraXV Extreme+ with you on the go and support up to 10 devices on the built-in mobile hotspot. Awesome belongs to your organization with Galaxy A15 5G. Built with all the essential features, Galaxy A15 5G makes it easier to embrace cutting-edge innovation while providing exceptional value. Meet the new Galaxy Tab A9+ 5G, your all-in-one tablet for all your organization's needs. Make every workday epic with the Galaxy S24. From researching case studies online to capturing stunning pics for your web content, do more easily with the Galaxy S24, just like that. For new lines and upgrades,Galaxy S23 FE is jam-packed with features including a long-lasting battery, a premium processor, a smooth and strong display, a triple-lens camera and more. With 2-year/1-year agreement,Powerful performance with defense-grade security. Keep your data safe with Knox multilayered security, including protection from the chip to the cloud. Get powerful performance with reliable Verizon 5G, built-in Knox Security for defense-grade protection and a long lasting battery. Plus, a versatile hi-res camera and the power to collaborate with Microsoft and Google integrations. With Verizon 4G LTE, free yourself from Wifi and stay productive where your business and the classroom take you. Samsung Galaxy Chromebook® Go is solidly built to endure everyday bumps and bruises, and its battery can power through the day without needing to sit by a power outlet. MIL-STD-810H & 1.5m drop tested. IP68 rated to stand up to dust, dirt, sand and water. Defense-grade security with Samsung Knox helps keep your data secure. Programmable keys for push-to-talk. Long lasting replaceable battery. Make every workday more productive with Galaxy Tab S9 FE Wi-Fi, featuring a powerful processor, a long-lasting battery and a dynamic 10.9 screen* to help you stay on top of your goals. Rugged Design is built to industry-leading Rugged Performance Standards, including MIL-STD-810H31 and Non-Incendive Class I, II, and III Div 2 ratings. Ultra-rugged and has a new 2.8 dynamic screen with programmable buttons to tailor your device to how you work. A strong multi-shift battery and large, glove-friendly keypad. Large 16GB storage. For new lines and upgrades,Galaxy S23 FE is jam-packed with features including a long-lasting battery, a premium processor, a smooth and strong display, a triple-lens camera and more. Capture incredible detail with a 48MP Main camera. Experience iPhone in a whole new way with Dynamic Island and Always-On, on the beautifully sized 6.1-inch display. And get peace of mind with groundbreaking safety features. Capture incredible detail with a 48MP Main camera. Experience iPhone in a whole new way with Dynamic Island and Always-On display, on the beautifully sized 6.7-inch display. And get peace of mind with groundbreaking safety features. Think big with a larger 6.7-inch display and all-day battery life. Capture stunning photos in low light and bright light with the new dual-camera system. Get peace of mind with groundbreaking safety features. Remarkable battery life. Emergency SOS via satellite. Crash Detection calls for help when you can't. Get an advanced dual-camera system. Lightning-fast A15 Bionic chip. A big leap in battery life. Durable design. Superfast 5G. And a brighter Super Retina XDR display. iPhone 13 Pro Max. Super Retina XDR display with ProMotion for a faster, more responsive feel. Durable design and the best battery life ever in an iPhone. iPhone 13. The most advanced dual-camera system ever on iPhone. Lightning-fast A15 Bionic chip. A big leap in battery life. Durable design. Superfast 5G. And a brighter Super Retina XDR display. iPhone SE. With the power iPad Pro features the powerful Apple M1 chip with next-level performance and all-day battery life. The Liquid Retina display on the 11-inch iPad Pro is not only gorgeous, but super portable. iPad Pro features the powerful Apple M1 chip for next-level performance and all-day battery life.1more information in foot notes An immersive 12.9-inch Liquid Retina XDR display for viewing. With Google Tensor G3 and the certified Titan M2 security chip, Pixel is built with multiple layers of security to help keep your personal info safe.* Plus, Pixel will receive the latest OS and security updates for 7 years.** With the immersive 6.7-inch display you can draft emails, input data and read documents with ease.* With Google Tensor G3 and the certified Titan M2 security chip, Pixel is built with multiple layers of security to help keep your personal info safe.** Plus, Pixel will receive the latest OS and security updates for 7 years.*** Engineered by Google, the Pixel 7a is priced right for your organization's budget. The Pixel 7a provides Google's top of the line productivity and security features. The Google Pixel 7, with a 6.3 display, Google Tensor G2, and Titan M2 security chip to help keep information secure. Mobile Broadband or M2M plan of $19.99 or higher. The mobile hotspot that delivers a next level, virtually lag-free connected experience powered by Verizon 5G and Wi-Fi 6 for up to 32 Wi-Fi-enabled devices, including laptops and tablets. With its solid performance, reliable experience, and enhanced security features, DuraForce PRO 3 offers enterprise-level durability and functionality to help keep teams connected wherever they are. Large 6.1 Glove & Wet Touch capable, scratch resistant FHD+ display, a programmable PTT button and MIL-STD-810H tested for a phone you can rely on. Lightweight, rugged, and IP68 certified to be washable and easily sanitized. TAA compliant. MCPTT supported. Awesome belongs to your organization with Galaxy A15 5G. Built with all the essential features, Galaxy A15 5G makes it easier to embrace cutting-edge innovation while providing exceptional value. Meet the new Galaxy Tab A9+ 5G, your all-in-one tablet for all your organization's needs. Make every workday epic with the Galaxy S24. From researching case studies online to capturing stunning pics for your web content, do more easily with the Galaxy S24, just like that. For new lines and upgrades,Galaxy S23 FE is jam-packed with features including a long-lasting battery, a premium processor, a smooth and strong display, a triple-lens camera and more. With 2-year/1-year agreement,Powerful performance with defense-grade security. Keep your data safe with Knox multilayered security, including protection from the chip to the cloud. MIL-STD-810H & 1.5m drop tested. IP68 rated to stand up to dust, dirt, sand and water. Defense-grade security with Samsung Knox helps keep your data secure. Programmable keys for push-to-talk. Long lasting replaceable battery. Get powerful performance with reliable Verizon 5G, built-in Knox Security for defense-grade protection and a long lasting battery. Plus, a versatile hi-res camera and the power to collaborate with Microsoft and Google integrations. Make every workday more productive with Galaxy Tab S9 FE Wi-Fi, featuring a powerful processor, a long-lasting battery and a dynamic 10.9 screen* to help you stay on top of your goals. Rugged Design is built to industry-leading Rugged Performance Standards, including MIL-STD-810H31 and Non-Incendive Class I, II, and III Div 2 ratings. Ultra-rugged and has a new 2.8 dynamic screen with programmable buttons to tailor your device to how you work. A strong multi-shift battery and large, glove-friendly keypad. Large 16GB storage. Meet the TCL LINKZONE 5G UW. The super-fast and efficient mobile hotspot that allows you to create your own secure Wi-Fi network so you can work, play, and stream on the go. Devices listed are available to new and existing customers, pricing subject to contract terms and conditions. Pricing excludes taxes and fees, and are subject to change without notice. Discount: $100 Bill Incentive Credit (BIC) issued as a lump sum credit after 2-3 bill cycles Eligible devices: 4G/5G smartphones Eligible Transactions: Port-in only Purchase Types: 2yr/1yr (Gov). Plan Requirement: Price Plan of $34.99 or higher. Available to government-liable subscribers only and subject to the terms, provisions and conditions of Verizon Wireless-approved government contracting vehicles. See terms and conditions of your contract. Pricing excludes taxes and fees and is subject to change without notice. Offer ends 6.30.2024. Discount: $199.99 instant discount applied at point of sale Eligible Devices: Samsung Galaxy S23 FE (128 GB) Eligible Transactions: New Activations, Upgrades Purchase Types: 2 yr/1 yr (Gov) Plan Requirements: $15.00+ with data feature; State & Local - $19.99+ with data feature; State of TN – flat rate plan with data feature (must meet Price Plan requirement). Available to government-liable subscribers only and subject to the terms, provisions and conditions of Verizon Wireless-approved government contracting vehicles. An Offer Recovery Fee (ORF) will be assigned to NASPO MA 152 customer lines that take advantage of select quarterly offers and will be charged on the customer's bill if the line is disconnected before the end of the line term. It may also apply to other contracts based on ECPD profile. 5G and 5G UWB may not be available to all government customers. See terms and conditions of your contract. Pricing excludes taxes and fees and is subject to change without notice. Offer ends 6.30.2024. Discount: $150 instant discount applied at point of sale Eligible Devices: Apple iPhone 13 (128 GB) Eligible Transactions: New Activations, Upgrades Purchase Types: 2yr/1yr (Gov). Plan Requirement: Fed - $15+ with data feature; State & Local - $19.99+ with data feature; State of TN - flat rate plan with data feature (must meet PP requirement). Available to government-liable subscribers only and subject to the terms, provisions and conditions of Verizon Wireless-approved government contracting vehicles. An Offer Recovery Fee (ORF) will be assigned to NASPO MA 152 customer lines that take advantage of select quarterly offers and will be charged on the customer's bill if the line is disconnected before the end of the line term. It may also apply to other contracts based on ECPD profile. 5G and 5G UWB may not be available to all government customers. See terms and conditions of your contract. Pricing excludes taxes and fees and is subject to change without notice. Offer ends 6.30.2024. Discount: $279.99 instant discount applied at point of sale. Eligible Devices: Google Pixel 7 128GB Eligible Transactions: New Activations, Upgrades Purchase Types: 2yr/1yr (Gov). Plan Requirement: Fed - $15+ with data feature; State & Local - $19.99+ with data feature; State of TN - flat rate plan with data feature (must meet PP requirement). Available to government-liable subscribers only and subject to the terms, provisions and conditions of Verizon Wireless-approved government contracting vehicles. An Offer Recovery Fee (ORF) will be assigned to NASPO MA 152 customer lines that take advantage of select quarterly offers and will be charged on the customer's bill if the line is disconnected before the end of the line term. It may also apply to other contracts based on ECPD profile. 5G and 5G UWB may not be available to all government customers. See terms and conditions of your contract. Pricing excludes taxes and fees and is subject to change without notice. Offer Ends: 6.30.2024. Discount: $249.99 instant discount applied at point of sale. Eligible Devices: Sonim XP10 128GB Eligible Transactions: New Activations, Upgrades Purchase Types: 2yr/1yr (Gov). Plan Requirement: Fed - $15+ with data feature; State & Local - $19.99+ with data feature; State of TN - flat rate plan with data feature (must meet PP requirement). Available to government-liable subscribers only and subject to the terms, provisions and conditions of Verizon Wireless-approved government contracting vehicles. An Offer Recovery Fee (ORF) will be assigned to NASPO MA 152 customer lines that take advantage of select quarterly offers and will be charged on the customer's bill if the line is disconnected before the end of the line term. It may also apply to other contracts based on ECPD profile. 5G and 5G UWB may not be available to all government customers. See terms and conditions of your contract. Pricing excludes taxes and fees and is subject to change without notice. Offer ends 6.30.2024. Discount: $249.99 instant discount applied at point of sale Eligible Devices: Kyocera DuraSport 5G UW Eligible Transactions: New Activations, Upgrades Purchase Types: 2 yr/1 yr (Gov) Plan Requirements: Fed - $15+ with data feature; State & Local - $19.99+ with data feature; State of TN - flat rate plan with data feature (must meet PP requirement). Available to government-liable subscribers only and subject to the terms, provisions and conditions of Verizon Wireless-approved government contracting vehicles. An Offer Recovery Fee (ORF) will be assigned to NASPO MA 152 customer lines that take advantage of select quarterly offers and will be charged on the customer's bill if the line is disconnected before the end of the line term. It may also apply to other contracts based on ECPD profile. 5G and 5G UWB may not be available to all government customers. See terms and conditions of your contract. Pricing excludes taxes and fees and is subject to change without notice. Offer Ends: 6.30.2024Available to government-liable subscribers only and subject to the terms, provisions and conditions of Verizon Wireless approved government contracting vehicles. 5G and 5G Ultra Wideband may not be available to all government customers. Early termination may be subject to offer recovery fee. See the terms and conditions of your contract. © 2024 Verizon. . * Indicates a required field. These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. We use both third party and first party cookies for this purpose. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance. These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly. These cookies may be set through our site by Verizon and third parties. They are used to present Verizon advertising on third party sites that you may visit. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising from Verizon. BackClear Filters,All Consent Allowed
Learn more2023 Payment Security Report and Insights for PCI White Paper Business
Welcome! We are ready to support your communication and collaboration needs. Chat now for assistance. Advanced PCI security program management design white paperThe 5x5 cube on the cover depicts the complexity of security program management. Designing a security program can be like trying to solve a mechanical three-dimensional (3D) combination puzzle. Each move affects the rest of the design and overall system. While some people struggle to solve the puzzle's quintillions of options, others solve it within a few seconds. The difference has to do with their methodology. Instead of a trial-and-error approach, combination puzzles are most easily solved by using a method. You can expend lots of time spinning the puzzle's cubes until you line up some semblance of a solution that meets your needs. Or you can use a reliable, logical method to cut time, effort and cost and quickly solve the problem with the best possible results. Similarly, Payment Card Industry (PCI) security programs require the alignment of multiple elements. This complexity can be vastly reduced with a sound program design—the application of a method to apply the correct sequence of steps—and by understanding the cause-and-effect relationships between moves. The cube on the cover highlights specific rows and columns (in yellow), representing the need to focus: resolving specific components within the perspective of the larger system. The entire system can be brought into alignment step by step, using a methodical and systemic approach to sequentially align individual layers rather than with random moves and attempts to solve the entire puzzle all at once. After the 3D combination puzzle is fully solved, it's shuffled, and the entire process is started all over again—reminding us of ongoing PCI security compliance programs where controls fall out of place and components (people, processes and technology) require ongoing attention. All control environments are subject to entropy, where a security control environment declines into disorder. During the 20-year history of PCI security compliance, Verizon has highlighted several leading methods and models that significantly simplify the complexity of PCI security program design and management. This report delves into an integrated method that incorporates those models and can significantly shorten the effort and time needed to solve your PCI security compliance management puzzle. This paper provides an overview of what we have learned from 20 years of Payment Security Report (PSR) research on critical success factors and design approaches for Payment Card Industry (PCI) security programs. It presents an integrated set of time-tested models, methods, techniques and concepts highlighted in the PSR that continue to add substantial value to organizations. Organizations need a method that offers clear visibility and perspective to establish and retain control over their payment card security programs and deliverables. They need approaches with methods that focus on moving from treating symptoms to addressing the causes of poor security program performance—making program input, performance and output highly predictable. Several compliance management program designs were tried and tested during the past decade. Verizon evaluated, designed and published a series of models, methods and techniques to help organizations successfully navigate the complexity of PCI security compliance management challenges. This paper presents an integrated approach, using some of the best methods and models available, for organizations of all sizes and across industries to help simplify and improve the design and operation of virtually every aspect of their PCI security program. For more than 20 years, Verizon has been exploring and refining security models and advancing security program designs to help organizations achieve predictable performance and overall program success by design. The methods and concepts highlighted in this paper can help organizations more easily design programs and projects, focus on what matters, simplify security compliance operating environments, and overcome the most important constraints by:,These essential tools and models can help you refine an existing program or design new programs based on lessons learned from thousands of organizations that successfully craft PCI security compliance management. A mental model is a representation of how something works—a concept or process. A model is used to better understand that process by cutting away as much as possible to focus on key aspects. It's difficult to keep all of the details of a system or environment in our brains. That's why models are used to simplify the complex into understandable and organizable chunks. The right structure for operational processes, management and controls presents substantial advantages to help a PCI security program run smoothly and efficiently. Within security and compliance programs, mental models are very useful to help determine context for presenting information to security program participants. Models help us consider why some elements are more relevant than others. They help us reason, see through the process, structure it, summarize and concentrate on what's important. Models shape people's views of the security control environment, how individuals understand the control environment, and the function and relationships between its components. They also shape the views individuals and teams have about their own capabilities, the tasks they perform and their learning curve. All of this depends heavily on the conceptualizations. For further reading, see "Mental Models: The Best Way to Make Intelligent Decisions (~100 Models Explained)" at . Mental models simplify complexity. Models present design, operations and management structures that are important to businesses of all sizes because they provide a way to organize and direct employees, delegate tasks, and make decisions about security compliance programs. They support how organizations can best structure activities to coordinate and manage individuals and teams to achieve organizational goals and objectives. Models help delineate formal communication channels and describe how separate individual actions are linked together. Mental models are likely to be inaccurate to some extent insofar as they are heuristics, and they cannot encapsulate all aspects of a system. —George E. P. Box,—Chris Sanders,Clear specification of the goal of a PCI security program is one of the most important first steps in program design. Communicating why the program exists and what you are aiming to accomplish is a critical success factor for all PCI security endeavors. Specification of the goal is the standard against which you evaluate reality to determine whether the program is succeeding. Yet, despite its importance, surprisingly few organizations include a clearly articulated goal statement in their program documentation. You cannot achieve adequate leadership and strategy without defining the purpose of PCI security compliance. Passing a compliance validation assessment is hardly sufficient as the specification of the end goal of a PCI security program. The intermediate objectives toward the goal should include the effective and sustainable protection of data. There should be continual improvement toward higher levels of process and capability maturity, with controllable processes, predictable outcomes and measurable performance across the control environment. The overall organizational goal of a PCI security compliance program is to develop, maintain and continually improve a mature control environment that offers reasonable assurance for the effective, ongoing protection of payment card data in a consistent, predictable and sustainable manner. To achieve this goal, the PCI security compliance program is integrated with and supported by additional security, risk management and governance frameworks; a security operating model; a strategy; and a security business model. Five important components are included in this goal statement:,The overall program goal is what your team should and may be aiming for, and it should influence every decision, task and activity within your compliance strategy and program. Therefore, the overall purpose of compliance with the PCI DSS and the intended overall desired outcome should be carefully defined. Start the design of a PCI security program by identifying the overall goal of your system. Then, develop your strategy around the achievement of the goal with prioritized, intermediate objectives to accomplish the requirements—the critical success factors of the goal. Tactics will follow from this. Organizations that develop tactics first and implement them locally (suboptimization) tend to stall within a few iterations. Usually, the rest of the organization doesn't sufficiently understand the direction of the security and compliance team. You need a systemic/global optimum approach to your strategy and tactics. For further reading, see the Verizon 2022 PSR, pages 8, 18 and 25 through 31; page 86 on PCI DSS Key Requirements goal statements; and "Appendix A: Primer for crafting security and compliance goals" on page 146. The level of effort of any PCI security program is ultimately determined by three major factors:,Even when a team is very proficient, it cannot perform well when it's distracted and lacks focus. Many organizations continue to measure the success of their PCI DSS programs by the outcome of their compliance validation assessments. That usually only measures the compliance validation side of the endeavor. You can measure the success of a compliance program in various ways. For example, from a project and program management perspective, you can measure the performance of the program in traditional project management metrics, such as time-based key performance indicators (KPIs) (cycle time, one-time completion, number of changes, hours planned vs hours spent), budget-based KPIs (budget vs actual expense), and milestones and phases covered to date. The performance of the project in terms of the efficiency, effectiveness and efficacy of the resources does not tell you much about the extent of the risk and how well payment card account data is protected by the organization. It relates to the progress made toward mitigating the risk of and liabilities associated with noncompliance with the PCI security compliance regulation. Begin with the end in mind. Define the goal. All program participants should have a clear understanding of what the program aims to achieve. You need at least a basic definition and consensus on what a successful outcome looks like for the program. Success is recognized by the following five outcomes:,Get the right work done with evidence of assurance that its control environment and key controls are effective in meeting the intent of all control objectives. (See pages 13 and 42 of the Verizon 2018 PSR on how to measure control effectiveness.),Produce economical program results, executed in a better manner with minimum waste of resources. Program design and execution are neither tactical nor reactive and are strategically aligned to support the overall business strategy. (See pages 29 and 30 of the 2022 PSR for how to measure strategy.),Compliance management is a marathon, not a sprint. It requires sustainable life cycle management of the controls and the environment. Program processes must continually progress toward higher process capability maturity. (See pages 25 through 29 of the Verizon 2019 PSR for measurement and maturity models.),Each of these outcomes can be achieved by design. To achieve these five critical success criteria, you need to know the basic scope of each and how to design, execute and measure them. The design and management of a successful, strategic PCI security program requires an integrated perspective. This means end-to-end visibility of the primary building blocks and critical inputs and outputs of the program. This is also a critical success factor for the program to be effective and sustainable. PCI security management programs are not temporary endeavors. Compliance with PCI security regulation is a long-term business concern that requires strategic planning to develop the capability to sustain ongoing compliance operations for many years. Organizations that attempt to design and operate security compliance programs without the deliberate, structured integration of the security business model, security strategy, security operating model, and security frameworks and standards face an uphill battle treating the consequences. They step straight into program design and management pitfalls that should be avoided. Poorly designed programs continually demand treating symptoms because they were not created on a solid foundation sufficiently aligned with the business mission, vision and operations of the rest of the organization. The Security Management Canvas (TSMC) addresses several root causes for poor program performance. The overall organizational goal of a PCI security compliance program is to develop, maintain and continually improve a mature control environment that offers reasonable assurance for the effective, ongoing protection of payment card data in a consistent, predictable and sustainable manner. To achieve this goal, the PCI security compliance program is integrated with and supported by additional security, risk management and governance frameworks; a security operating model; a strategy; and a security business model. This management model is based on 20 years of experience with PCI security program performance management and was developed and published by Verizon in the 2020 and 2022 PSRs. (See pages 15 through 17, "Elements of a high-performance data security environment," in the 2020 PSR.) TSMC is an exceptionally powerful framework that places any PCI security program into the correct perspective and ordered sequence. Its five pillars present an integrated set of documents that all organizations should develop, maintain and apply. Note that the security program is on pillar five—for very good reason. It highlights the dependencies on the output of the preceding pillars. It provides a rich, contextual perspective on what the team needs to know about the scope as well as the necessary inputs and outputs for successfully managing an efficiently effective PCI security compliance management program. This structure unlocks the potential for doing the right work in the right order and doing it well. Every decision and action taken for your security compliance program fits into this canvas. Every organization needs to invest in these pillars of activity for a solid foundation. For further reading, The Security Management Canvas is explained in greater detail in the 2022 PSR, pages 32 through 41. A single view,The Security Management Canvas provides a single view of the entire security and compliance management process. It presents the foundational blocks of an effective management system. The design and implementation of a program based on TSMC structure can produce highly valuable, essential documents and produce the exact input needed to make important decisions throughout the program life cycle. You may save yourself a lot of time and effort if you use TSMC to evaluate the progress of your program against the components and their relationships on this canvas, find what you missed, calculate the consequences of missing or neglecting steps, and make the correction. X,Many organizations isolate their PCI security compliance programs from broader governance programs, not realizing the effectiveness and efficiency of a synchronized approach, which avoids overlap and repetition of tasks between various programs. A unified compliance approach to meet various regulatory requirements under a single corporate governance umbrella has significant compliance and risk management benefits. Organizations should, at least annually, revisit the goals, requirements and constraints of their governance program. Is your PCI security program fully integrated with your larger corporate governance, risk management and compliance initiatives?,GRC is an umbrella term for a management discipline and operational framework. To ensure the realization of organizational goals and objectives, GRC—which stands for governance, risk management and compliance—requires an integrated, organizationwide approach to establish clearly defined, measurable standards of performance. In other words, the main purpose of GRC as a business practice is to develop and maintain a well-coordinated and integrated collection of capabilities to support predictable and reliable performance at every level of the organization. It's a structured approach to align IT with business objectives while effectively managing risk and meeting compliance requirements. Organizations should develop this essential capability to achieve goals and strategic objectives and meet stakeholder needs. The scope of GRC does not end with just governance, risk management and compliance. It includes assurance and performance management. When done right, a GRC approach offers better decision-making agility and confidence; reduction in costs, duplication and affected operations; sustained, reliable performance; and delivery of value. Verizon developed and published the GRC Model in the 2022 PSR, page 21. The synchronized integration of all GRC activities translates into increased efficiency and bottom-line financial benefits for businesses. You can spend hours searching the web for resources like the one you're reading now, or you can sign up to receive relevant assets from us that are meant to help keep you informed and grow your business. For many organizations, a large part of the journey in PCI security and compliance is about moving from a disjointed set of activities to creating a formalized program. When an organization's security direction becomes a series of disjointed initiatives and policies, the outcome is inevitable: a drop in compliance, reduced control effectiveness and increased risk of a breach. To recover, the chief information security officer (CISO) must provide agile leadership and well-structured governance supported by clear communication and strong directives. The use of models and methods can play a significant role in the process of reorganizing to move forward. Too often, security programs are developed in an ad hoc manner—in a reactive mode with little advanced planning. A well-defined program provides guidance on how to make decisions and allocate resources to achieve overarching program objectives. Program and project design and management are fundamental skills and processes for PCI security success. Program design is important because it oils all of the parts that make the program run efficiently as a whole. Program and project design typically refer to the initial planning phase conducted by the PCI security compliance steering committee, project managers and primary stakeholders. This planning phase develops important project elements to help ensure success. Strategy is the heart that pushes a program forward. Instead of short-term projects with small, immediate goals, security must evolve into a long-term program with a mission, objectives and strategy that improves the security posture of the organization. The key objectives of the CISO often include formulating an information security program that leverages collaborations and organizationwide resources, facilitating information security governance, advising senior leadership on security direction and resource investments, and designing appropriate policies to manage information security risk. A PCI security program should be designed to deliver predictable performance throughout the life cycle of the program. It requires resources to be directed toward a clearly defined goal and establishment of an economical road map with milestones and critical success factors. A well-designed program increases efficiency, accomplishes objectives, and gives internal and external stakeholders what they want every single time. It's a solution for eliminating the waste of resources, addressing low productivity, preventing excessive costs and avoiding stakeholder dissatisfaction. A well-designed PCI security program:,The following list contains common mistakes organizations make when designing security management programs:,For further reading, see "General data protection program management principles," 2019 PSR, page 18. Program improvement initiatives,There are only two ways to improve the performance and outcome of a PCI security program:,There is no other way. Best results are achieved when you apply a method for logically integrating the improvement of components and procedures. It's important to know that the achievement of sustainable control effectiveness depends on the overall control environment. You should never assume you can improve your compliance environment without including in the equation the effects of your higher-level environments. You need to know how your PCI security compliance subsystems relate to the larger systems in which they operate. This requires the application of systems thinking (see the 2022 PSR, pages 9 and 71). An organization's control environment has a pervasive impact on the overall system of control. Most aspects of program performance are directly or indirectly influenced by other components within the (larger) control environment. Designing and performing tests at the control environment level can be a complex and challenging task—hence, many organizations focus their attention only on the lower-level subenvironments. We often refer to control environments to explain the overall larger system within which a PCI security compliance environment operates. A control environment is a continual managerial process with structures and standards that provides the basis for carrying out internal control across the organization. It should be clearly defined, documented, communicated, evaluated and maintained. It's comprehensive—meaning it includes all the actions taken by management to manage the environment; strategic governance and operational day-to-day management of activities; and all participants, policies, standards and procedures, tools, processes, and documents. These three environments make up your entire integrated control system. Each of these environments is briefly explained below. The control environment is the broad, overall environment, and it includes both external and internal control environments. The performance and maturity of the overall control environment directly influences and often determines the performance of its subenvironments. This environment includes all the external entities that are capable of exercising influence over conditions within your organization. For example, each business has various external entities that have influenced or can influence aspects of their business and components (people, processes, documentation and IT systems) and that also affect the organization's internal control environment. This environment is governed internally by a set of structures, policies, processes and standards that provides the basis for carrying out internal control across the organization. It includes all the control activities, information and communication, risk assessments, and monitoring activities that the organization applies to adhere to internal policies, standards and procedures. This environment typically includes your broader governance, risk and compliance scope—PCI security as well as other regulations to which an organization must adhere. Competent people understand their responsibilities and the limits of their authority within an effective control environment. They are knowledgeable, mindful and committed to doing what is right and doing it the right way. An effective control system rapidly detects and discloses where failures are occurring and what/who is responsible for the failures. It ensures that corrective action is taken, and performance is measured, reported and continually improved. This environment includes all compliance components (system components and other components within the scope of compliance and validation). Some are included in the CDE, and some are outside the CDE, such as the connected-to and security impacting system components. This scope includes all applicable system components, people and processes that are subject to PCI DSS control requirements. In addition to the CDE, other in-scope components include:,This scope includes all of the compliance validation assessment tasks that must be applied to system components, people and processes—regardless of whether they are included or excluded from the scope of compliance. For example, during external assessments, qualified security assessors are required to sample various components, even when they are excluded from the defined scope of compliance. This is done to confirm that all the required scoping and compliance criteria are met, to validate the accuracy of the defined scope, and to confirm the compliance of all components. The validation scope will always be larger and include more system components than the scope of compliance. Any system that is in scope of compliance is automatically also included in the scope of validation, but not the other way around. The CDE is the core payment account data storage, transmission and processing environment in the scope of PCI DSS compliance and validation. It includes all system components that store processes or transmit payment account data (cardholder data or sensitive authentication data)—referred to above as an SPT component. Compliance environment,The compliance environment may also include components subject to requirements from other PCI security standards (apart from the DSS) that make up the broader organizationwide scope of the payment card data security compliance environment. This presents the body of in-scope components that are required to be in place for the security of payment card account data and compliance with PCI DSS requirements. To reduce the scope of compliance, organizations should avoid any unnecessary inclusion of system components, people and processes from the CDE. Such components often still need to be included in the scope of validation to substantiate and confirm the validity of their exclusion from the scope of compliance. Sustainable security and compliance are understood as the development of a control environment that meets the needs of the present without compromising the ability to meet goals and objectives in the future. According to 2022 PSR key findings (page 82), fewer than half (about 43%) of organizations maintain sustainable control environments. Too many organizations don't know how to effectively measure the strength of their PCI security programs. Control environments and security controls tend to degrade if they are not maintained. Organizations often don't notice a deviation from the performance standard because they don't monitor and measure the performance. They also may not have a standard against which they can measure the performance of the program or an effective method for executing program evaluation. This deficiency usually results in a series of negative consequences, such as:,To address this need, Verizon published 9 Factors of Control Effectiveness and Sustainability in the 2018 PSR (pages 4 through 23). This important model helps organizations apply an integrated evaluation framework for determining the sustainability and effectiveness of a PCI security program. The framework allows for a highly structured, repeatable and consistent method to identify blind spots across the PCI security program. It also facilitates the process of obtaining critical input to define and monitor the internal and external control environment and the controls needed to mitigate risks. At the same time, organizations also need to identify and define the constraints that affect control performance and data protection effectiveness and sustainability as well as define and communicate performance requirements and standards for the design and operation of the control environment. Control sustainability,In addition to being effective, all critical controls need to be sustainable to reliably meet control objectives. It's important to monitor, frequently measure and report the ability of all critical security control systems to consistently meet all applicable control objectives over extended periods of time. This required level of security control performance needs to be maintained without critical control systems experiencing any significant deviations from their standards of configuration and functional specifications. The level of sustainability that any security control system can achieve depends largely on the extent to which it's aligned and integrated with its control environment. Therefore, the sustainability of the control environment directly influences the sustainability of controls within the environment. Tracking the amount of effort and resources (cost, people, attention and time) needed to maintain the required performance and effectiveness can provide important indicators of control sustainability. It's also necessary to monitor the sufficiency of the capacity, capability, competence, commitment and communication requirements in all critical process areas across the environment. (See page 24, "The necessity and value of control design templates."),In general, sustainability issues can get introduced in various stages of the program. For more information, see "The PCI security program management life cycle" on page 20. To achieve sustainable compliance and data protection, you need to remain in control and proactively manage two challenges: the volume of the workload and the complexity of the tasks. If the volume exceeds your capacity to process it or the complexity exceeds your comprehension to understand and manage the cause-and-effect interaction between components, it will directly affect sustainability. Do not allow the volume of components (information, systems or tasks) to exceed the resource capacity of the people and systems to process it in a timely manner. Do not allow the complexity of the tasks to exceed the capability or competence of the people and systems. Control and reduce the scope wherever possible to reduce the amount of work associated with the control environment. Use templates, and establish work routines and workflows. Automate as many tasks as possible to reduce the manual input required. Only work on tasks that contribute to the achievement of the program goal. Increase the available resources (i.e. hire more people or outsource tasks to third parties). In general, most issues surrounding complexity can be resolved through analysis and communication and working in a structured manner. That is why integrating your compliance program into a structured change control process is so beneficial to achieve sustainability. To deliver a high-performance PCI security program, you need to design it—to achieve success by design—with predictable evolution and performance. How the program is constructed matters. All programs have critical elements and fundamental components. To help address root causes of poor program performance, programs should contain all of these critical components. The components have dependencies and interdependencies and come into focus within various stages of the program's life cycle. All programs have life cycles—stages they go through from conception to eventual end. Life cycles are essential for delivering and improving the sustainability of program performance. This visual model (Figure 5) is a great way to establish a perspective on how program activities should be structured and how the workflow progresses from conception to completion. A security compliance program refers to the life cycle management of a program with defined stages such as:,Programs do not exist and operate by themselves. They are created, and their performance is a consequence of how they are designed and interact with the rest of the organization. Therefore, the program structure and approach taken to produce the program architecture—the organization of and relationships between the components and order of execution—matters a great deal. Clear and well-known dependencies and cause-and-effect relationships determine the effectiveness, efficiency of execution and outcomes of a program. The life cycle of a program is not too different from project life cycle management—but essential differences exist. The difference between programs and projects is that projects have relatively shorter durations than programs. This is the conception and initiation of the program followed by the planning activities to scope out the work. After the program is launched, a structured, predetermined method is needed for managing and controlling the performance of the work. This includes control of the scope, resource capacity and other key metrics within all associated projects. It is initiated after the launch of the program and runs in parallel with program management. You need to measure the effectiveness and efficiency of the program. Review the qualities of the program deliverables, and evaluate the maturity of capabilities and processes. Program and project life cycle management is, and should be, an integrated part of PCI security program management. It's part of the solution to a high-performance program. The performance of a program, the collection of projects managed collectively by the program, and the rate at which objectives (throughput) are achieved toward the overall outcomes and goals is directly dependent on the quality of the design and execution during each life cycle stage. You shouldn't ignore life cycle management when aiming for a successful program. If you skip one of these steps in any of the stages, it will have a negative effect down the line. In addition to program management life cycles, program designs should also incorporate security control life cycles. Verizon published a security control life cycle framework in the Verizon 2016 PSR (page 7), republished an updated version in the 2017 edition (page 10) and expanded on the framework in the 2018 PSR (page 17). Data should always be protected by layers of security. The effectiveness with which security controls are managed at each step of their life cycle determines the likelihood of control risk creating exposure and a potential data breach. Lack of understanding of the control life cycle is a factor that can lead to atrophy in control environments. This can ultimately result in security breaches and data compromises. Breaches occur because of the absence or failure of multiple security controls. Controls fail as a result of weaknesses in design, operation or maintenance. In many cases, this is the result of an ineffective control environment. Therefore, it's essential that organizations understand how each stage of the control life cycle can influence the underlying processes, operational efficiency and effectiveness of security controls. Using templates provides substantial benefits for control system improvement, including the ease, transparency and consistency they provide in deploying, operating and maintaining controls. Templates assist in the early detection of control design and control operation issues. They also contribute toward the effectiveness and strength of the control environment, providing much-needed perspective on control purpose, function and operational limitations. At a basic level, a typical PCI DSS control profile document should include the following:,For more details on documenting control profiles, see page 12 of the 2018 PSR and page 60 of the 2022 PSR. Many organizations overemphasize efficiency with their PCI security program management approaches. Such approaches tend to measure and incentivize the implementation of PCI security requirements in the shortest possible time. This often leads to a "checkbox" approach, which may not result in producing a truly effective control environment. Doing specific tasks in an optimized way that results in the least waste of time, effort and resources,Doing the right tasks to achieve the required outcome, regardless of the time it takes—the ability to produce a better result that delivers more value or achieves a better outcome,So effectiveness is doing the right tasks, while efficiency is doing tasks right. Either requires the assumption that you can define what the right outcome is and what tasks should be done. And it isn't one or the other. Although you should try to be effective first, you also need to consider how efficiently you are spending your time and resources. Efficiently doing the wrong tasks is a waste of time; efficiently doing the right ones is how you succeed. A team that is highly efficient but lacks effectiveness may spend too much time ensuring that deadlines are reached and boxes are ticked. They may do this without prioritizing the right projects. Teams need to identify what needs to be done (establish the correct goals and objectives). Only then should investments be made to optimize processes to work more efficiently. Improved efficiency increases the speed and volume of output. But the results can still be wrong. A focus on efficiency can also be a distraction from achieving goals. Keep in mind that any task that isn't furthering your organization's security and compliance goals doesn't really matter. The 7 Data Security Principles,There is immense value in understanding the principles of data security. These are the fundamental building blocks for the design and management of a successful PCI security program:,Do not neglect the fundamental principles. Effectiveness means understanding that the best outcome is a moving target. It requires using foresight to determine where resources should be invested for the best results. Effective teams invest time and energy where their influence will be greatest. Improved effectiveness increases the achievement of the intended results. However, it may be achieved at a slower rate if the production process has low efficiency. Do you want to go faster in the wrong direction or slower toward the correct destination?,Lack of data security sustainability and effectiveness is largely the result of poor business, strategic and operational architecture design and execution. (See the 2020 PSR, pages 12 and 22 through 61, for elaboration on these traps.) Addressing these impediments will not only build a strong compliance bridge but also a program that can adapt when necessary. Finding the balance—becoming efficiently effective,With so much to do, organizations understand the value of being productive. Although security and compliance teams strive to be more efficient and want to tick off more daily to-do list items and complete more in less time, they need to prioritize work that contributes to the achievement of goals—that is, prioritizing effectiveness over efficiency. All PCI security programs should be designed to prioritize effectiveness before efficiency. Ultimately, teams should strive to become efficiently effective, which means doing the right things well and maintaining the correct balance between efficiency and effectiveness. This concludes this brief paper on advanced payment security program design. For details on advanced security program evaluation, please reach out to the Verizon Payment Security Practice at,This research publication is a product of Verizon Cyber Security Consulting, a global leader in payment security with a security team of more than 600 consultants in 30 countries. Verizon has one of the leading teams of PCI qualified security assessors. Verizon is the longest-running global PCI security services provider in the world, offering services since 2002. Our payment security practice provides PCI security and SWIFT consulting, assessments and program maturity improvement services. Across our Cyber Security Consulting portfolio, Verizon offers services that help clients identify, protect, detect, respond and recover from cyberthreats while helping ensure compliance with applicable regulations and standards. Direct access to our collection of payment security research reports:,Verizon 2023 Payment Security Report insights,Advanced PCI security program management design white paper,Published August 2023Lead author: Ciske van Oosten,Lead editor: Cynthia B. HansonManaging Director, Security: Kristof Philipsen,Associate Director, Global GRC leader: Sam JunkinGlobal lead: Sebastien Mazas,Americas region: Matt Arntsen,APAC region: Ferdinand Delos Santos,EMEA region: Loic Breat,Global business intelligence: Ciske van Oosten,Legal review: Rishard Cooper, Sudha Kantor George E. P. Box, "Science and statistics," Journal of the American Statistical Association, Taylor & Francis, Ltd. on behalf of the American Statistical Association, 1976. Chris Sanders, "Information Security Mental Models," May 29, 2019,,"Mental Models: The Best Way to Make Intelligent Decisions (~100 Models Explained)," Farnam Street, accessed July 28, 2023,,See page 15 for an explanation of "control environment.","2022 Payment Security Report," Verizon, 2022,,"2018 Payment Security Report," Verizon, 2018,,"2019 Payment Security Report," Verizon, 2019,,2020 Payment Security Report," Verizon, 2020,,Ron Carroll, "Box Theory™ for small business—create high-performance systems," accessed August 7, 2023. "2016 Payment Security Report," Verizon, 2016,,"2017 Payment Security Report," Verizon, 2017,,If you are already a Verizon customer, we have several options to help you get the support you need. Choose your country to view contact details. Existing customers, to your business account or . . * Indicates a required field. We will follow up from your contact request using the information provided. These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. We use both third party and first party cookies for this purpose. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance. These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly. These cookies may be set through our site by Verizon and third parties. They are used to present Verizon advertising on third party sites that you may visit. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising from Verizon. BackClear Filters,All Consent Allowed
Learn moreDBIR Report 2022 - Results and Analysis - Not the Human Element Business
The information provided will be used in accordance with our terms set out in our . Please confirm you have read and understood this Notice. By submitting the form, you are agreeing to receive insights, reports and other information from Verizon and affiliated companies in accordance with our . California residents can view our . Verizon may wish to contact you in the future concerning its products and/or services. If you would like to receive these communications from Verizon, indicate by selecting from the dropdown menu below. Please note that you can unsubscribe or update your preferences at any time. Indicates a required field. The content access link will be emailed to you. You will soon receive an email with a link to confirm your access, or follow the link below. You may now close this message and continue to your article. We discuss many things related to the human element in the DBIR: Phishing, Credentials, Errors, etc. However, this section is about the entry point into your organization that does not directly involve a human asset: Vulnerabilities. The action variety of Exploit vulnerability is up to 7% of breaches this year, doubling from last year. While it's not on par with the massive numbers we see in Credentials and Phishing, it's worth some thought. The first question one might reasonably ask is "How are attackers findingWhat we found is the median company in all categories had almost no vulnerabilities (with random organizations being just a bit higher). This can happen because so many breaches aren't tied to vulnerabilities. However, the tails of the distribution tell a different story. While security-concerned organizations run a pretty tight ship, the other three have organizations out in the tail with far more vulnerabilities per internet-facing host. And if you wonder who the threat actors from Figure 43 are looking for, it's the organizations in that tail. Remember that for many attackers it's simply a numbers game—they just want some amount of access—and those tails still provide enough of an incentive for them to continue to try the exploits until they get lucky. The good news is we are getting better. Figure 44 shows vulnerability remediation speed and completeness over the last six years. Higher is better in this Figure and, in general, things are looking up. We're patching more and we're patching faster. Another bright spot is that last year we talked about Gini coefficients, (basically a measure of if a few things happened a lot and a lot of things happened only a few times). We apply that in Figure 46 to the different levels of the Pyramid of Pain. For the non-threat intelligence expert, the Pyramid of Pain is a model used by threat intelligence analysts to categorize the value of different indicators to the defender. The base of the pyramid is trivial for the attacker to modify (like the hash of a file) and therefore less useful to the defender. The tip of the pyramid is extremely difficult to modify by the attacker (like the attacker's established process also known as Tactics, Techniques and Procedures (TTPs)). What we found was that other than hashes, most indicators in the Pyramid of Pain have pretty high Gini coefficients. That means that if you block the first few percent of that indicator, you stop most of the malice. Frankly we expected that the Gini coefficient would go up as we went up the pyramid, but from IP addresses on up, they are all about the same. We see something similar with IPs back in Figure 43. Only 0.4% of the IPs that attempted RCEs weren't seen in one of the prior phases showing what SecOps probably already know: Block bad IPs!,You may notice we didn't get the TTPs at the top of the pyramid. The reality is the DBIR team just doesn't have this data. But check out Appendix B: VERIS & Standards for ATT&CK Flow: a solution to this data collection problem!,2,249 incidents, 1,063 with confirmed data disclosure,External (100%) (breaches),Financial (89%), Espionage (11%) (breaches),Credentials (63%), Internal (32%), Personal (24%), Other (21%) (breaches),These attacks continue to be split between Phishing attacks and the more convincing Pretexting attacks, which are commonly associated with Business Email Compromises. The human element continues to be a key driver of 82% of breaches and this pattern captures a large percentage of those breaches. Additionally, malware and stolen credentials provide a great second step after a social attack gets the actor in the door, which emphasizes the importance of having a strong security awareness program. This year, 82% of breaches in the DBIR involved the human element. This puts the person square in the center of the security estate with the Social Engineering pattern capturing many of those human-centric events. As you can see in Figure 49, the Social Engineering pattern is dominated by Phishing. And we know what you're going to say: "I'm so surprised! Fetch my fainting couch!" But in a way the chart highlights the numerous paths a social engineering breach can take. We see where the phish steals credentials to then be used in "Use of stolen creds." We see Business Email Compromises (BECs) (with the E for email being directly tied to the phish) in "Pretexting." We see malware being dropped in "Downloader" and "Ransomware" (which, by the way, goes up to 17% of Social Engineering when we are discussing incidents rather than breaches), hacking in "Scan network" and "Profile host," and persistence in "Backdoor or C2." All in all, it highlights the fact that phishing is one of the four main entry points into an organization. Sutton's law tells us "When diagnosing, first consider the obvious." Thus, if you wonder why criminals phish, it is because email is where their targets are reachable. And while only 2.9% of employees may actually click on phishing emails, a finding that has been relatively steady over time, that is still more than enough for criminals to continue to use it. For example, in our breach data alone, there were 1,154,259,736 personal records breached. If we assume those are mostly email accounts, 2.9% would be 33,473,532 accounts phished, (akin to successfully phishing every person in Peru). The good news is we are getting better at reporting phishing. Figure 48 shows a steady climb with an increase of roughly 10% in phishing test emails reported in the last half decade. The question is "Can your organization both act on the 12.5% that reported and find the 2.9% that clicked?",In Figure 49, we see that Pretexting is 27% of Social Engineering breaches, almost all of which are BECs. While we call these attacks BECs, they tend to be a bit more complex than just some bad actor impersonating someone through a compromised email account. Only 41% of BECs involved Phishing. Of the remaining 59%, 43% involved Use of stolen credentials against the victim organization. The percentage remaining were most likely BECs using an email from a partner, or utilizing a free email account of some type requiring no "C" at all. BECs come in many forms: your organization may be targeted due to a breach in a partner, your partners may be targeted due to a breach of your emails, you may be breached and then targeted using your own breach, or as pointed out earlier, there may be no breach at all, just an attacker with a convincing story about why they need your money. Figure 50 gives an idea of how much of that money the criminals feel they need. It appears they saw inflation on the horizon and granted themselves a raise this year. Regardless, you, being the erudite reader of the DBIR that you are, can do something about it. File a complaint at ic3.gov and get in touch with the FBI IC3 Recovery Asset Team (RAT). In cases where the RAT acts on BECs, and works with the destination bank, half of all US-based BECs had 93% of the money either recovered or frozen, whereas only 14% had nothing at all recovered. "Malware? I already read about it in the Action section. Why do I have to hear about malware again?!" Because there's lots of it! Although, we admit there is a degree of bleed-over in the sections. This year we saw more things that fell into two patterns than we did last year. With System Intrusion and Social Engineering being chief among them. As Figure 38 in the System Intrusion section points out, email is the most common malware delivery method, at least initially. Figure 52 shows that, in breaches, providing a Backdoor or Command and Control (C2), followed by delivering a Downloader are the top two things actors are looking to do once their successful phish lands their malware. If the phish busts through the door, Figure 52 shows that the Backdoor, C2, and Downloader hold it open for all the rest of the actions to make their way in. It is noteworthy that while Ransomware shows up about half way down the list in breaches, the same analysis for incidents has Downloader and Ransomware moving into the top two spots with 74% and 64% of malware incidents respectively. This definitively proves that we can't write a single section of the DBIR this year without mentioning Ransomware at least once. Clearly the Human Element leaves a lot to be desired when it comes to information security. Even when a breach is not directly caused by a person, the information systems were still built by people. Frankly, we'd rather have people solving the problems since asking the AI to do it sounds much trickier. Unfortunately, nothing is perfect. Not people, not processes, not tools, not systems. But, we can get better, both at what we do and what we build. To that end, training is a big part of improving. Figure 51 gives an idea of the amount of phishing training folks are taking per year. Most training takes twice as long to complete than was expected with 10% taking three times as long. Training can potentially help improve security behaviors, in both day-to-day (such as Don't Click… Stuff, and using a password keeper) as well as in design (such as secure coding, lifecycle management, etc.). Unfortunately, while getting training is easy, proving it's working is a bit harder. If you want some pointers on how to do it, have a look at Appendix C: Changing Behavior. And by average, we mean median because statistics isn't hard enough already. Mode. "The Pyramid of Pain", Bianco, David J. , January 2014. Not just the Social Engineering pattern. Along with Credentials, Vulnerabilities, and pre-existing Bots. "Personal" doesn't have to be email. It could be addresses and names and such, but it normally includes email. And this doesn't even count credentials where the username is often an email. Ok, so 59% times 43%, carry the 1, convert to roman numerals... that's like 25% of all BECs!,Compromise,Unless that whole bigfoot thing is true. We sent Dave to a conference to find out but haven't heard back. Not DBIR Authors (This is debatable. We asked the Oracle, rolled some bones, and signs pointed to "probably perfect"). If you are already a Verizon customer, we have several options to help you get the support you need. Choose your country to view contact details. Existing customers, to your business account or . These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. We use both third party and first party cookies for this purpose. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance. These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly. These cookies may be set through our site by Verizon and third parties. They are used to present Verizon advertising on third party sites that you may visit. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising from Verizon. BackClear Filters,All Consent Allowed
Learn more