PCI DSS COMPLIANCE 101

Size: px
Start display at page:

Download "PCI DSS COMPLIANCE 101"

Transcription

1 PCI DSS COMPLIANCE 101 Pavel Kaminsky PCI QSA, CISSP, CISA, CEH, Head of Operations at Seven Security Group Information Security Professional, Auditor, Pentester

2 SEVEN SECURITY GROUP PCI QSA Сompany Own Implementation Team Own Penetration Testing Team

3 PCI DSS?

4 PCI DSS 101 PCI Security Standards Council VISA, MC, AMEX, JCB, DISCOVERY Comprehensive, in-depth, detailed Valid for 1 year, recertification

5 PCI SSC RESOURCES PCI DSS, PA-DSS, P2PE, PTS (POI, HSM & PIN), Card Production and supporting documents Registry of QSAs, PA-QSAs, PCIPs, ASVs, Validated Payment Applications, PTS Devices, P2PE Solutions PCI FAQ Education & Outreach Programs Participating Organization Membership, Community Meetings, Feedback

6 PAYMENT BRANDS COMPLIANCE PROGRAMS Payment Brands: Have their own Compliance Program Are responsible for CP enforcement Define forensic investigations Respond to account data compromises Compliance Programs include: Tracking and enforcement Penalties, fees, compliance deadlines Validation process and who needs to validate Approval and posting of compliant entities Definition of merchant and service provider levels

7 PCI DSS - WHY IT S IMPORTANT? SEVERE PENALTIES: Security breaches cost a lot You can be suspended from processing credit card transactions You can face higher processing fees IN CASE OF A COMPROMISE, NON-COMPLIANT MEMBERS OR THEIR NON-COMPLIANT MERCHANTS OR AGENTS ARE LIABLE TO PAY: Non-compliance fine Forensic investigation costs Dispute resolution costs Card re-issuance penalties Breach notification costs

8 VERIZON PAYMENT SECURITY REPORT Of all the payment card data breaches the Verizon Threat Research Advisory Center team investigated over the past 12 years, not a single organization was fully PCI DSS compliant at the time of the breach.

9 THE REQUIREMENTS 6 CATEGORIES Build and maintain a secure network and systems Protect cardholder data Maintain a vulnerability management program Implement strong access control measures Regularly monitor and test networks Maintain an information security policy

10 PCI DSS COMPLIANCE PCI DSS Compliance is determined based on how your organization stores, processes, and/or transmits cardholder data across your infrastructure Compliance is based on Level and Type Level is based on the number of transactions performed in a 12-month period Type is defined by how your organization takes credit cards Depending on what Type of organization you are, you will have to address anywhere from 20 to 360 controls Depending on what Level of compliance you are, you will have to report your compliance with Self-Assessment Questionnaire (SAQ) or Report on Compliance (ROC) by QSA

11 LEVELS OF COMPLIANCE SERVICE PROVIDERS MERCHANTS ROC by QSA SAQ ROC by QSA SAQ SAQ SAQ

12 REPORTING ROC, SAQ

13 REPORTING ROC (Report on Compliance) SAQ (Self-Assessment Questionnaire) AOC (Attestation of Compliance) PENTESTING VULNERABILITY SCANNING (by ASV)

14 THE 12 REQUIREMENTS 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor-supplied defaults for system passwords and other security parameters 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open, public networks 5. Protect all systems against malware and regularly update antivirus software or programs 6. Develop and maintain secure systems and applications 7. Restrict access to cardholder data by business need to know 8. Identify and authenticate access to system components 9. Restrict physical access to cardholder data 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes 12. Maintain a policy that addresses information security for all personnel

15 PCI DSS RECOMMENDED UNDERSTANDING PCI DSS TELLS YOU WHAT YOU NEED TO DO, WHAT CONTROLS YOU NEED TO MEET TO BE COMPLIANT PCI DSS does not tell you how to become compliant, that is individual to your situation and your environment: Your systems Your processes Your vendors Your customers BEING COMPLIANT DOES NOT NECESSARY MAKE YOU SECURE. BEING SECURE LEADS TO COMPLIANCE NOT THE OTHER WAY AROUND.

16 PCI DSS - COMMON PCI MYTHS We don t have enough card transactions to require compliance We outsource card processing so we are compliant PCI is an IT issue PCI is unreasonable / difficult PCI compliance makes us secure We are not a target

17 THIRD PARTY PROVIDERS/VENDORS MERCHANT SHARED SERVICE PROVIDER Third Party Vendor affecting security of CHD is always in scope EACH client can request SEPARATE auditing 3 RD PARTY PROVIDER Third party vendor own certification covers the applicable part REMEMBER: choose PCI-DSS certified counteragents for all solutions in scope, for example your datacenter, MSSP's, etc.

18 THE APPROACH (ON-SITE)

19 SCOPING SCOPING: Together with you, we analyze your cardholder data environment, which forms the scope of certification in order to minimize it as well as the necessary implementation work.

20 PRELIMINARY ASSESSMENT PRELIMINARY ASSESSMENT: Provides a check of the current state of the cardholder data environment for conformity with the PCI DSS requirements. The results reveal any necessary adjustments and additions that provide our customers with detailed and meaningful information that defines remedial actions for compliance.

21 FORMAL ASSESSMENT FORMAL ASSESSMENT: Mandatory on-site assessment, performed by Qualified Security Assessor (QSA) and resulting in the issuance of final PCI DSS compliance report (ROC) and Attestation of Compliance (AOC).

22 ONGOING SUPPORT ONGOING SUPPORT: We advise and support our customers in all matters relating to PCI DSS compliance and during the entire process of analysis, remediation and implementation of corrective measures and controls.

23 THE ASSESSMENT A TWO-HORSE SLED DESIGN AND IMPLEMENTATION: Documented policies and processes OPERATING EFFECTIVENESS: Evidence gathering and interviews with responsible personnel

24 YOU WOULD NEED TO PROVIDE... Network diagram(s) Cardholder data flow diagram(s) Physical locations Network and server equipment People involved Technologies used and your guys would need to participate too

25 KEEP CALM AND AND GET CERTIFIED Thank you! Pavel Kaminsky, PCI QSA, CISSP, CISA, CEH Head of Operations at Seven Security Group

PCI DSS 3.2 AWARENESS NOVEMBER 2017

PCI DSS 3.2 AWARENESS NOVEMBER 2017 PCI DSS 3.2 AWARENESS NOVEMBER 2017 1 AGENDA PCI STANDARD OVERVIEW PAYMENT ENVIRONMENT 2ACTORS PCI ROLES AND RESPONSIBILITIES MERCHANTS COMPLIANCE PROGRAM PCI DSS 3.2 REQUIREMENTS 2 PCI STANDARD OVERVIEW

More information

Navigating the PCI DSS Challenge. 29 April 2011

Navigating the PCI DSS Challenge. 29 April 2011 Navigating the PCI DSS Challenge 29 April 2011 Agenda 1. Overview of Threat and Compliance Landscape 2. Introduction to the PCI Security Standards 3. Payment Brand Compliance Programs 4. PCI DSS Scope

More information

PCI COMPLIANCE IS NO LONGER OPTIONAL

PCI COMPLIANCE IS NO LONGER OPTIONAL PCI COMPLIANCE IS NO LONGER OPTIONAL YOUR PARTICIPATION IS MANDATORY To protect the data security of your business and your customers, the credit card industry introduced uniform Payment Card Industry

More information

The Devil is in the Details: The Secrets to Complying with PCI Requirements. Michelle Kaiser Bray Faegre Baker Daniels

The Devil is in the Details: The Secrets to Complying with PCI Requirements. Michelle Kaiser Bray Faegre Baker Daniels The Devil is in the Details: The Secrets to Complying with PCI Requirements Michelle Kaiser Bray Faegre Baker Daniels 1 PCI DSS: What? PCI DSS = Payment Card Industry Data Security Standard Payment card

More information

PCI DSS Addressing Cyber-Security Threats. ETCAA June Gabriel Leperlier

PCI DSS Addressing Cyber-Security Threats. ETCAA June Gabriel Leperlier Welcome! PCI DSS Addressing Cyber-Security Threats ETCAA June 2017 - Gabriel Leperlier Short Bio Current Position Head of Continental Europe Advisory Services at Verizon. Managing 30+ GRC/PCI/Pentest Consultants

More information

Comodo HackerGuardian. PCI Security Compliance The Facts. What PCI security means for your business

Comodo HackerGuardian. PCI Security Compliance The Facts. What PCI security means for your business Comodo HackerGuardian PCI Security Compliance The Facts What PCI security means for your business Overview The Payment Card Industry Data Security Standard (PCI DSS) is a set of 12 requirements intended

More information

Merchant Guide to PCI DSS

Merchant Guide to PCI DSS 0800 085 3867 www.cardpayaa.com Merchant Guide to PCI DSS Contents What is PCI DSS and why was it introduced?... 3 Who needs to become PCI DSS compliant?... 3 Card Pay from the AA Simple PCI DSS - 3 step

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Self-Assessment Questionnaire A-EP For use with PCI DSS Version 3.2.1 July 2018 Section 1: Assessment Information Instructions

More information

Payment Card Industry (PCI) Compliance

Payment Card Industry (PCI) Compliance Payment Card Industry (PCI) Compliance February 13, 2019 To Receive CPE Credit Individuals Participate in entire webinar Answer polls when they are provided Groups Group leader is the person who registered

More information

PCI DSS. Compliance and Validation Guide VERSION PCI DSS. Compliance and Validation Guide

PCI DSS. Compliance and Validation Guide VERSION PCI DSS. Compliance and Validation Guide PCI DSS VERSION 1.1 1 PCI DSS Table of contents 1. Understanding the Payment Card Industry Data Security Standard... 3 1.1. What is PCI DSS?... 3 2. Merchant Levels and Validation Requirements... 3 2.1.

More information

Your guide to the Payment Card Industry Data Security Standard (PCI DSS) banksa.com.au

Your guide to the Payment Card Industry Data Security Standard (PCI DSS) banksa.com.au Your guide to the Payment Card Industry Data Security Standard (PCI DSS) 1 13 13 76 banksa.com.au CONTENTS Page Contents 1 Introduction 2 What are the 12 key requirements of PCIDSS? 3 Protect your business

More information

Payment Card Industry Data Security Standards Version 1.1, September 2006

Payment Card Industry Data Security Standards Version 1.1, September 2006 Payment Card Industry Data Security Standards Version 1.1, September 2006 Carl Grayson Agenda Overview of PCI DSS Compliance Levels and Requirements PCI DSS v1.1 in More Detail Discussion, Questions and

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Merchants Version 3.0 February 2014 Section 1: Assessment Information Instructions for Submission This

More information

A Perfect Fit: Understanding the Interrelationship of the PCI Standards

A Perfect Fit: Understanding the Interrelationship of the PCI Standards A Perfect Fit: Understanding the Interrelationship of the PCI Standards 9/5/2008 Agenda Who is the Council? Goals and target for today s Webinar Overview of the Standards and who s who PCI DSS PA-DSS PED

More information

Understanding PCI DSS Compliance from an Acquirer s Perspective

Understanding PCI DSS Compliance from an Acquirer s Perspective Understanding PCI DSS Compliance from an Acquirer s Perspective J.P. Morgan April 2017 Andy Goh Matt Leman P C I P A Y M E N T B R A N D O V E R V I E W & C O M P L I A N C E E N A B L I N G T E C H N

More information

The PCI Security Standards Council

The PCI Security Standards Council The PCI Security Standards Council 2/29/2008 Agenda The PCI SSC Roles and Responsibilities How To Get Involved PCI SSC Vendor Programs PCI SSC Standards PCI DSS Version 1.1 Revised SAQ 2/29/2008 2 The

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Self-Assessment Questionnaire A For use with PCI DSS Version 3.2 Revision 1.1 January 2017 Section 1: Assessment Information

More information

Evolution of Cyber Attacks

Evolution of Cyber Attacks Update from the PCI Security Standards Council Troy Leach, CTO, PCI Security Standards Council Evolution of Cyber Attacks Viruses Worms Trojan Horses Custom Malware Advanced Persistent Threats 1 Modern

More information

Commerce PCI: A Four-Letter Word of E-Commerce

Commerce PCI: A Four-Letter Word of E-Commerce Commerce PCI: A Four-Letter Word of E-Commerce Presented by Matt Kleve (vordude) http://www.flickr.com/photos/shawnzlea/527857787/ Who is this guy? 5 years of Drupal Been in the PCI 'trenches' Drupal Security

More information

Payment Card Industry Internal Security Assessor: Quick Reference V1.0

Payment Card Industry Internal Security Assessor: Quick Reference V1.0 PCI SSC by formed by: 1. AMEX 2. Discover 3. JCB 4. MasterCard 5. Visa Inc. PCI SSC consists of: 1. PCI DSS Standards 2. PA DSS Standards 3. P2PE - Standards 4. PTS (P01,HSM and PIN) Standards 5. PCI Card

More information

FAQs. The Worldpay PCI Program. Help protect your business and your customers from data theft

FAQs. The Worldpay PCI Program. Help protect your business and your customers from data theft The Worldpay PCI Program Help protect your business and your customers from data theft What is the Payment Card Industry Data Security Standard (PCI DSS)? Do I have to comply? The PCI DSS is a set of 12

More information

Advanced Certifications PA-DSS and P2PE. Erik Winkler, VP, ControlCase

Advanced Certifications PA-DSS and P2PE. Erik Winkler, VP, ControlCase Advanced Certifications PA-DSS and P2PE Erik Winkler, VP, ControlCase ControlCase Annual Conference Miami, Florida USA 2017 PCI Family of Standards Ecosystem of payment devices, applications, infrastructure

More information

2012PHILIPPINES ECC International :: MALAYSIA :: VIETNAM :: INDONESIA :: INDIA :: CHINA

2012PHILIPPINES ECC International :: MALAYSIA :: VIETNAM :: INDONESIA :: INDIA :: CHINA Effective Data Security Measures on Payment Cards through PCI DSS 2012PHILIPPINES ECC International :: MALAYSIA :: VIETNAM :: INDONESIA :: INDIA :: CHINA Learning Bites Comprehend the foundations, requirements,

More information

Will you be PCI DSS Compliant by September 2010?

Will you be PCI DSS Compliant by September 2010? Will you be PCI DSS Compliant by September 2010? Michael D Sa, Visa Canada Presentation to OWASP Toronto Chapter Toronto, ON 19 August 2009 Security Environment As PCI DSS compliance rates rise, new compromise

More information

ISACA Kansas City Chapter PCI Data Security Standard v2.0 Overview

ISACA Kansas City Chapter PCI Data Security Standard v2.0 Overview ISACA Kansas City Chapter PCI Data Security Standard v2.0 Overview February 10, 2011 Quick Overview RSM McGladrey, Inc. Greg Schu, Managing Director/Partner Kelly Hughes, Director When considered with

More information

PCI Compliance: It's Required, and It's Good for Your Business

PCI Compliance: It's Required, and It's Good for Your Business PCI Compliance: It's Required, and It's Good for Your Business INTRODUCTION As a merchant who accepts payment cards, you know better than anyone that the war against data fraud is ongoing and escalating.

More information

Webinar: How to keep your hotel guest data secure

Webinar: How to keep your hotel guest data secure Webinar: How to keep your hotel guest data secure Securing your hotel guest data Wednesday April 18, 2018 2:00 pm ET WEBINAR HOST Joshua Molina Ed Vasko Chief Executive Officer QUESTIONS? Type them in

More information

Protect Comply Thrive. The PCI DSS: Challenge or opportunity?

Protect Comply Thrive. The PCI DSS: Challenge or opportunity? Protect Comply Thrive The PCI DSS: Challenge or opportunity? The PCI challenge First unveiled in 2004, the Payment Card industry Data Security Standard (PCI DSS) is the result of collaboration between

More information

David Jenkins (QSA CISA) Director of PCI and Payment Services

David Jenkins (QSA CISA) Director of PCI and Payment Services David Jenkins (QSA CISA) Director of PCI and Payment Services PCI and the Cloud, where is my Atlas Agenda About Cognosec PCI DSS 3.0 and CSPs SLA Considerations Technical considerations Auditing About

More information

PCI compliance the what and the why Executing through excellence

PCI compliance the what and the why Executing through excellence PCI compliance the what and the why Executing through excellence Tejinder Basi, Partner Tarlok Birdi, Senior Manager May 27, 2009 Agenda 1. Introduction 2. Background 3. What problem are we trying to solve?

More information

All the Latest Data Security News. Best Practices and Compliance Information From the PCI Council

All the Latest Data Security News. Best Practices and Compliance Information From the PCI Council All the Latest Data Security News Best Practices and Compliance Information From the PCI Council 1 What is the PCI Security Standards Council? Collaboration Education Simplified solutions for merchants

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Self-Assessment Questionnaire P2PE For use with PCI DSS Version 3.2.1 July 2018 Section 1: Assessment Information Instructions

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.1 April 2015 Section 1: Assessment Information Instructions for Submission

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.2.1 June 2018 Section 1: Assessment Information Instructions for Submission

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.2 April 2016 Section 1: Assessment Information Instructions for Submission

More information

Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A and Attestation of Compliance

Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A and Attestation of Compliance Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A and Attestation of Compliance Card-not-present Merchants, All Cardholder Data Functions Fully Outsourced For use with

More information

PDQ Guide for the PCI Data Security Standard Self-Assessment Questionnaire C (Version 1.2)

PDQ Guide for the PCI Data Security Standard Self-Assessment Questionnaire C (Version 1.2) PDQ has created an Answer Guide for the Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire C to help wash operators complete questionnaires. Part of the Access Customer Management

More information

The Future of PCI: Securing payments in a changing world

The Future of PCI: Securing payments in a changing world The Future of PCI: Securing payments in a changing world Lauren Holloway 2014 Nature of the Threat About the Council PCI DSS Updates Staying Secure How You Can Participate In Closing Agenda Nature of the

More information

June 2013 PCI DSS COMPLIANCE GUIDE. Look out for the tips in the blue boxes if you use Fetch TM payment solutions.

June 2013 PCI DSS COMPLIANCE GUIDE. Look out for the tips in the blue boxes if you use Fetch TM payment solutions. If your business processes Visa and MasterCard debit or credit card transactions, you need to have Payment Card Industry Data Security Standard (PCI DSS) compliance. We understand that PCI DSS requirements

More information

PCI DSS v3. Justin

PCI DSS v3. Justin PCI DSS v3 Justin Leapline justin.leapline@giftcards.com @jmleapline My Experience With PCI Just to lay the groundwork Currently work at Largest ecommerce in Pittsburgh My experience includes: QSA Acquirer

More information

in PCI Regulated Environments

in PCI Regulated Environments in PCI Regulated Environments JULY, 2018 PCI COMPLIANCE If your business accepts payments via credit, debit, or pre-paid cards, you are required to comply with the security requirements of the Payment

More information

Site Data Protection (SDP) Program Update

Site Data Protection (SDP) Program Update Advanced Payments October 9, 2006 Site Data Protection (SDP) Program Update Agenda Security Landscape PCI Security Standards Council SDP Program October 9, 2006 SDP Program Update 2 Security Landscape

More information

How PayPal can help colleges and universities reduce PCI DSS compliance scope. Prepared by PayPal and Sikich LLP.

How PayPal can help colleges and universities reduce PCI DSS compliance scope. Prepared by PayPal and Sikich LLP. How PayPal can help colleges and universities reduce PCI DSS compliance scope. Prepared by PayPal and Sikich LLP. Reduce time and resources needed for PCI DSS compliance. Campus merchants want to offer

More information

Customer Compliance Portal. User Guide V2.0

Customer Compliance Portal. User Guide V2.0 Customer Compliance Portal User Guide V2.0 0 Copyright 2016 Merchant Preservation Services, LLC. All rights reserved. CampusGuard, the Merchant Preservation Services logo, and the CampusGuard logo are

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.1 April 2015 Section 1: Assessment Information Instructions for Submission

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.2 April 2016 Document2 Section 1: Assessment Information Instructions for

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.2 April 2016 Section 1: Assessment Information Instructions for Submission

More information

Daxko s PCI DSS Responsibilities

Daxko s PCI DSS Responsibilities ! Daxko s PCI DSS Responsibilities According to PCI DSS requirement 12.9, Daxko will maintain all applicable PCI DSS requirements to the extent the service prov ider handles, has access to, or otherwise

More information

Data Sheet The PCI DSS

Data Sheet The PCI DSS Data Sheet The PCI DSS Protect profits by managing payment card risk IT Governance is uniquely qualified to provide Payment Card Industry (PCI) services. Our leadership in cyber security and technical

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.2 April 2016 Section 1: Assessment Information Instructions for Submission

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Self-Assessment Questionnaire D Service Providers For use with PCI DSS Version 3.2 Revision 1.1 January 2017 Section 1:

More information

PCI DSS Illuminating the Grey 25 August Roger Greyling

PCI DSS Illuminating the Grey 25 August Roger Greyling PCI DSS Illuminating the Grey 25 August 2010 Roger Greyling +64 21 507 522 roger.greyling@security-assessment.com Lightweight Intro Dark Myths of PCI 3 Shades of Grey The Payment Card Industry Data Security

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.2 April 2016 Section 1: Assessment Information Instructions for Submission

More information

Data Security Standard

Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.2 April 2016 2006-2016 PCI Security Standards Council, LLC. All Rights Reserved.

More information

A QUICK PRIMER ON PCI DSS VERSION 3.0

A QUICK PRIMER ON PCI DSS VERSION 3.0 1 A QUICK PRIMER ON PCI DSS VERSION 3.0 This white paper shows you how to use the PCI 3 compliance process to help avoid costly data security breaches, using various service provider tools or on your own.

More information

Section 1: Assessment Information

Section 1: Assessment Information Section 1: Assessment Information Instructions for Submission This document must be completed as a declaration of the results of the merchant s self-assessment with the Payment Card Industry Data Security

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Self-Assessment Questionnaire D Version 3.2 Section 1: Assessment Information Instructions for Submission This document

More information

Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A and Attestation of Compliance

Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A and Attestation of Compliance Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A and Attestation of Compliance Card-not-present Merchants, All Cardholder Data Functions Fully Outsourced For use with

More information

Protect Comply Thrive. The PCI DSS: Challenge or opportunity?

Protect Comply Thrive. The PCI DSS: Challenge or opportunity? Protect Comply Thrive The PCI DSS: Challenge or opportunity? First unveiled in 2004, the Payment Card industry Data Security Standard (PCI DSS) is the result of collaboration between the major credit card

More information

AuthAnvil for Retail IT. Exploring how AuthAnvil helps to reach compliance objectives

AuthAnvil for Retail IT. Exploring how AuthAnvil helps to reach compliance objectives AuthAnvil for Retail IT Exploring how AuthAnvil helps to reach compliance objectives AuthAnvil for Retail IT Exploring how AuthAnvil helps to reach compliance objectives As companies extend their online

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments - Service Providers Version 3.2 April 2016 Section 1: Assessment Information Instructions for Submission

More information

Blueprint for PCI Compliance with Network Detective

Blueprint for PCI Compliance with Network Detective Blueprint for PCI Compliance with Network Detective WHITEPAPER by Win Pham, RapidFire Tools VP Development Copyright 2017 RapidFire Tools, Inc. All rights reserved. Table of Contents Target Audience...

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.1 April 2015 Section 1: Assessment Information Instructions for Submission

More information

SAQ A AOC v3.2 Faria Systems LLC

SAQ A AOC v3.2 Faria Systems LLC SAQ A AOC v3.2 Faria Systems LLC Self-Assessment Questionnaire A and Attestation of Compliance Version 3.2 Section 1: Assessment Information Part 1. Merchant and Qualified Security Assessor Information

More information

City of Portland Audit: Follow-Up on Compliance with Payment Card Industry Data Security Standard BY ALEXANDRA FERCAK SENIOR MANAGEMENT AUDITOR

City of Portland Audit: Follow-Up on Compliance with Payment Card Industry Data Security Standard BY ALEXANDRA FERCAK SENIOR MANAGEMENT AUDITOR City of Portland Audit: Follow-Up on Compliance with Payment Card Industry Data Security Standard BY ALEXANDRA FERCAK SENIOR MANAGEMENT AUDITOR Examples of Government data breaches in 2016, listing number

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.1 April 2015 Section 1: Assessment Information Instructions for Submission

More information

UCSB Audit and Advisory Services Internal Audit Report. Credit Cards PCI Compliance. July 1, 2016

UCSB Audit and Advisory Services Internal Audit Report. Credit Cards PCI Compliance. July 1, 2016 Internal Audit Report Credit Cards PCI Compliance July 1, 2016 Performed by: Jessie Masek, Associate Director Antonio Manas-Melendez, Principal Auditor Laurie Liao, Staff Auditor Approved by: Robert Tarsia,

More information

Credit Union Service Organization Compliance

Credit Union Service Organization Compliance Credit Union Service Organization Compliance How do SOC reporting and PCI requirements affect your overall compliance strategy? May 15 2012 Your Speakers Dennis Lavin Credit Union Assurance Partner Moderator

More information

Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A and Attestation of Compliance

Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A and Attestation of Compliance Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A and Attestation of Compliance Card-not-present Merchants, All Cardholder Data Functions Fully Outsourced For use with

More information

PCI DATA SECURITY STANDARDS VERSION 3.2. What's Next?

PCI DATA SECURITY STANDARDS VERSION 3.2. What's Next? PCI DATA SECURITY STANDARDS VERSION 3.2 What's Next? Presenters Alan Gutierrez Arana Director National PCI Leader RSM US LLP Gus Orologas, QSA Manager RSM US LLP Travis Wendling, QSA Supervisor RSM US

More information

Merchant Certificate of Compliance

Merchant Certificate of Compliance Merchant Certificate of Compliance Awarded To: Consolid S.R.L. (55504923) Self - Assessment Questionnaire Passed: SAQ D, v3.2r1.1 Date Awarded: 03/01/2018 Most Recent Scan Date: 06/04/2018 Certificate

More information

Managing Risk in the Digital World. Jose A. Rodriguez, Director Visa Consulting and Analytics

Managing Risk in the Digital World. Jose A. Rodriguez, Director Visa Consulting and Analytics Managing Risk in the Digital World Jose A. Rodriguez, Director Visa Consulting and Analytics What is driving the security landscape? Innovation New entrants New technologies New business models Data Compromises

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.1 April 2015 Section 1: Assessment Information Instructions for Submission

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.2 April 2016 Section 1: Assessment Information Instructions for Submission

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.2 April 2016 Section 1: Assessment Information Instructions for Submission

More information

The IT Search Company

The IT Search Company The IT Search Company PCI for Splunk @ Gala Coral Peter Bassill CISO Gala Coral Group The IT Search Company 2 Splunk Inc. 2010 Agenda My 2 minutes of Fame Who is Gala Overview of IT @ Gala What is PCI

More information

PCI DSS. A Pocket Guide EXTRACT. Fourth edition ALAN CALDER GERAINT WILLIAMS

PCI DSS. A Pocket Guide EXTRACT. Fourth edition ALAN CALDER GERAINT WILLIAMS PCI DSS A Pocket Guide Fourth edition ALAN CALDER GERAINT WILLIAMS Every possible effort has been made to ensure that the information contained in this book is accurate at the time of going to press, and

More information

GUIDE TO STAYING OUT OF PCI SCOPE

GUIDE TO STAYING OUT OF PCI SCOPE GUIDE TO STAYING OUT OF PCI SCOPE FIND ANSWERS TO... - What does PCI Compliance Mean? - How to Follow Sensitive Data Guidelines - What Does In Scope Mean? - How Can Noncompliance Damage a Business? - How

More information

Payment Card Industry (PCI) Data Security Standard Report on Compliance. PCI DSS v3.2.1 Template for Report on Compliance. Revision 1.

Payment Card Industry (PCI) Data Security Standard Report on Compliance. PCI DSS v3.2.1 Template for Report on Compliance. Revision 1. Payment Card Industry (PCI) Data Security Standard Report on Compliance PCI DSS v3.2.1 Template for Report on Compliance Revision 1.0 June 2018 Document Changes Date Version Description February 2014 July

More information

PCI & You: more than you wanted to know.

PCI & You: more than you wanted to know. PCI Training PCI & You: more than you wanted to know. Presented by: Date: Jason Murray February 1, 2017 Payment Card Industry Security Standards Many Different Forms of Payment Pay Now Pay Later Pay in

More information

University of Sunderland Business Assurance PCI Security Policy

University of Sunderland Business Assurance PCI Security Policy University of Sunderland Business Assurance PCI Security Policy Document Classification: Public Policy Reference Central Register IG008 Policy Reference Faculty / Service IG 008 Policy Owner Interim Director

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.2 April 2016 Section 1: Assessment Information Instructions for Submission

More information

Section 3.9 PCI DSS Information Security Policy Issued: November 2017 Replaces: June 2016

Section 3.9 PCI DSS Information Security Policy Issued: November 2017 Replaces: June 2016 Section 3.9 PCI DSS Information Security Policy Issued: vember 2017 Replaces: June 2016 I. PURPOSE The purpose of this policy is to establish guidelines for processing charges on Payment Cards to protect

More information

SIP Trunks. PCI compliance paired with agile and cost-effective telephony

SIP Trunks. PCI compliance paired with agile and cost-effective telephony SIP Trunks PCI compliance paired with agile and cost-effective telephony What is PCI DSS compliance? What does this mean for you? The Payment Card Industry Data Security Standard (PCI DSS) is the proprietary

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.2 April 2016 Section 1: Assessment Information Instructions for Submission

More information

PCI Compliance. Network Scanning. Getting Started Guide

PCI Compliance. Network Scanning. Getting Started Guide PCI Compliance Getting Started Guide Qualys PCI provides businesses, merchants and online service providers with the easiest, most cost effective and highly automated way to achieve compliance with the

More information

Ensuring Desktop Central Compliance to Payment Card Industry (PCI) Data Security Standard

Ensuring Desktop Central Compliance to Payment Card Industry (PCI) Data Security Standard Ensuring Desktop Central Compliance to Payment Card Industry (PCI) Data Security Standard Introduction Manage Engine Desktop Central is part of ManageEngine family that represents entire IT infrastructure

More information

Payment Card Industry (PCI) Data Security Standard. Requirements and Security Assessment Procedures. Version May 2018

Payment Card Industry (PCI) Data Security Standard. Requirements and Security Assessment Procedures. Version May 2018 Payment Card Industry (PCI) Data Security Standard Requirements and Security Assessment Procedures Version 3.2.1 May 2018 Document Changes Date Version Description Pages October 2008 1.2 July 2009 1.2.1

More information

Section 1: Assessment Information

Section 1: Assessment Information Section 1: Assessment Information Instructions for Submission This document must be completed as a declaration of the results of the merchant s self-assessment with the Payment Card Industry Data Security

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.2.1 June 2018 Section 1: Assessment Information Instructions for Submission

More information

Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI) Data Security Standard Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.2 April 2016 Section 1: Assessment Information Instructions for Submission

More information

Segmentation, Compensating Controls and P2PE Summary

Segmentation, Compensating Controls and P2PE Summary Segmentation, Compensating Controls and P2PE Summary ControlCase Annual Conference New Orleans, Louisiana USA 2016 Segmentation Reducing PCI Scope ControlCase Annual Conference New Orleans, Louisiana USA

More information

Overview: Compliance and Security Management PCI-DSS Control Compliance Suite Overview

Overview: Compliance and Security Management PCI-DSS Control Compliance Suite Overview PCI DSS stands for Payment Card Industry Data Security Standard. It was developed by the major credit card companies as a guideline to help organizations that process card payments prevent credit card

More information

Payment Card Industry (PCI) Point-to-Point Encryption. Template for Report on Validation for use with P2PE v2.0 (Revision 1.1) for P2PE Solution

Payment Card Industry (PCI) Point-to-Point Encryption. Template for Report on Validation for use with P2PE v2.0 (Revision 1.1) for P2PE Solution Payment Card Industry (PCI) Point-to-Point Encryption Template for Report on Validation for use with P2PE v2.0 (Revision 1.1) for P2PE Solution Revision 1.1 June 2017 Document Changes Date Use with Version

More information

Payment Card Industry - Data Security Standard (PCI-DSS)

Payment Card Industry - Data Security Standard (PCI-DSS) Payment Card Industry - Data Security Standard (PCI-DSS) Tills Security Standard (SAQ P2PE) Version 1-0-0 14 March 2018 University of Leeds 2018 The intellectual property contained within this publication

More information

Using GRC for PCI DSS Compliance

Using GRC for PCI DSS Compliance Using GRC for PCI DSS Compliance The ongoing struggle to protect sensitive credit card data will continue to escalate. Increasingly sophisticated attacks have targeted financial institutions of all sizes,

More information

Achieving PCI Compliance: Long and Short Term Strategies

Achieving PCI Compliance: Long and Short Term Strategies Achieving PCI Compliance: Long and Short Term Strategies Murray Goldschmidt - CISSP, QSA PCI DSS Compliance Conference, 3 Dec 2009 1 www.senseofsecurity.com.au Tuesday, August 11, 2009 Overview 1. PCI

More information

Welcome ControlCase Conference. Kishor Vaswani, CEO

Welcome ControlCase Conference. Kishor Vaswani, CEO Welcome ControlCase Conference Kishor Vaswani, CEO Agenda About ControlCase Key updates since last conference Certification methodology and support for new regulations Constant Compliance offering introduced

More information

PCI DSS Compliance for Healthcare

PCI DSS Compliance for Healthcare PCI DSS Compliance for Healthcare Best practices for securing payment card data In just five years, criminal attacks on healthcare organizations are up by a stunning 125%. 1 Why are these data breaches

More information

PCI Compliance. What is it? Who uses it? Why is it important?

PCI Compliance. What is it? Who uses it? Why is it important? PCI Compliance What is it? Who uses it? Why is it important? Definitions: PCI- Payment Card Industry DSS-Data Security Standard Merchants Anyone who takes a credit card payment 3 rd party processors companies

More information