PCI (payment card industry) dev standards - JIRA workflow???

[Ira Chandler]

We are a software company producing PCI-compliant credit card processing middleware. We want to use JIRA to handle the workflow. I have searched everywhere for a Jira workflow for PCI and find nothing. We are very familiar with the PCI requirements, and would love to find a workflow (even commercial) that already incorporates the same transitions and checks.

Does anyone know of any JIRA workflow that incorporates PCI requirements?

TIA

[Ira Chandler · Accepted solution]

After substantial investigation, we have determined that there is NO existing commercially available workflow to support the PCI requirements. We have also determined that the cost of consulting is such that we are better off to build it ourselves.

What we are building is a SIMPLE, linear PCI qualified workflow. It will also include the appropriate sections of OWASP.

IF YOU HAVE INTEREST in a JIRA PCI Workflow, contact me at my first name at Curbstone which is a dot com. We are not real interested in "selling" anything, but would appreciate input from other concerned parties with similar needs, as it could result in a more comprehensive deliverable.

PS - we have a basic template operational already.

[Deleted user]

Did you ever post your workflow?  I'm facing the same need and I've found one example of a PCI workflow but would like to see what others are doing.

http://www.data.proidea.org.pl/bitspiration/2013/slajdy/b13_d1_1530_sc_pci-dss.pdf

Jim

[Nic Brough -Adaptavist-]

It's not that hard to create a workflow, but it does take a bit of practice to get one absolutely right. So you've done the right thing in asking for help!

[Ira Chandler]

Yep, David. We can dev our stuff, but I can't take one person and give them a month to learn this, which any one of them could do - even by trial and error. I just had a call with Praecipio.comwho consults in this space and we are developing a SOW for a few hours of specific training. I will update you.

Do you have a design for your process yet?

Let's continue this via e-mail. My first name at my company's first name works well with a dot com.

Curbstone Corporation

[David Morrissey]

Ira - we are a software company. So probably in a similar space to yourself. Also a little light on resources :-)

[Ira Chandler]

Hey, David. No sauce. Apparently there is not a community or commercial PCI workflow. Anywhere. At all. So we are going to build it. However, we have found the Atlassian docs for the process of building one from scratch to be woefully inadequate, or we are dumb as rocks. So I have scheduled a call with a consulting outfit to provide tutoring (a few hours, maybe) to get us up and running with the process of scratching a workflow. Basically, the entity relationships are complex, and we cannot find where they are clearly laid out for this purpose. We have looked at the Summit videos and they help a little, but they ALL assume you understand the relationships of the fields, screens, schemes, steps, transitions, etc. etc. etc. etc. etc... We do freaking not.

I do have a general outline of the steps we are wanting to flow. Turning that into a workflow is more than I have resources to figure out.

Are you a merchant or a software company?

[David Morrissey]

Hi Ira,

have you had any joy in locating a workflow? We are also starting out on the PCI journey and I am also researching PCI workflow for JIRA.

Thanks,

David

[Andris Grinbergs]

As I know PCI dev companies create Jira workflows from scratch. And they don't sell them, because it's not their business area.

[Ira Chandler]

That is what I was afraid of. Seems like they could post them. That is what I intend to do, as we will have to create our own, apparently...

Thanks for the input.

[Nic Brough -Adaptavist-]

If you've found nothing so far, you might be better off creating your own.

I don't know what a PCI workflow looks like, but I've defined all sorts of workflows to meet all sorts of needs, based on little more than a basic flow chart or just talking through a process. Do you have anything that you can show us that is a PCI flow?