What do food safety and PCI compliance have in common? According to Kyle Welch, president of Chicago Scoops, they’re both essential for a successful restaurant. Chicago Scoops started as a single unit operator in May 2014 and is now the largest domestic franchisee of the Cold Stone Creamery brand.
“I put security on a par with sanitation. We wanted to be proactive about protecting our customers and brand from day one,” Welch said in conversation with HT Magazine & Cybera.1
However, in other ways, they couldn’t be more different. Food sanitation is a well understood requirement that is considered from the outset and baked into the food service process and workflow. The same cannot be said of PCI DSS which is an overwhelming tangle of confusing policy, process & technical guidelines. To make matters worse, its goal–to prevent breaches of payment cardholder data–is a moving target in a constantly evolving threat landscape.
Welch sums it up best. “Security and PCI compliance are a black-box to most of the franchise community, no matter how experienced they are. There are lots of variables like PCI-related questionnaires, technology scanning vendors, firewall and intrusion detection vendor options, etc. Many stores have minimal security or unprotected Wi-Fi, and residential Internet access is on the same connection as the payment data.”
[clickToTweet tweet=”Security and PCI compliance are a black-box to most of the franchise community.” quote=”“Security and PCI compliance are a black-box to most of the franchise community, no matter how experienced they are,””]
PCI compliance was top-of-mind for Welch because of the rapid growth of Chicago Scoops, who expanded their footprint through acquisitions and organic growth to span 31 locations across 10 states in a single month.
Like most branch locations, the ice cream stores had no onsite IT expertise. With a background as an internal efficiency consultant, Welch realized that Chicago Scoops needed a simple, uniform approach to protect their cardholder data environment, reduce their data breach exposure and achieve PCI compliance at two levels.
- Standardized security across all locations using an easy, template-based approach that scales for rollout and future store growth, but still accommodates the franchise exceptions that invariably arise
- Secure connectivity inside each store that runs over their existing network, regardless of the access technology
Chicago Scoops was an ideal candidate for Cybera’s managed, secure SD-WAN solution. Deployment at each store consisted of the following steps.
- Step 1: A non-technical employee plugs in the single edge platform device that was shipped to the store.
That’s it. The solution is purpose-built for non-technical personnel who need to focus on running the business and have only a few minutes to spare to plug in the solution.
Multi-layered security—VPN, firewall, IDS/IPS, MFA, malware protection, antivirus protection—protects all cardholder data, which is encrypted. Each application is partitioned into its own network segment, isolating it from all other apps to prevent lateral breaches across applications. Cybera’s 24x7x365 monitoring and cloud based solution enables a rapid response mechanism to threats as security updates/patches can be rolled out to all branches remotely and quickly.
That’s what we call Absolute Zero Touch Provisioning.TM The result is time and budget savings that allow you to focus on your core business and what really matters. Welch has since expanded to 37 stores and found other ways to use that time, such as serving on the Auxiliary Board for College Possible Chicago, running the company-sponsored charity One Scoop At a Time, mentoring and training future leaders, and playing basketball.
For more information on using Cybera to simplify PCI-compliance, download the ebook “Simplify PCI Compliance for Multi-Site Businesses”.