PCI Data Security Standard

The PCI DSS applies to all entities that store, process, and/or transmit cardholder data. It covers technical and operational system components included in or connected to cardholder data.

If you accept or process payment cards, PCI DSS applies to you.

PCI Data Security Standards

The Safeguards Rule applies to financial institutions subject to the FTC’s jurisdiction and that aren’t subject to the enforcement authority of another regulator under section 505 of the Gramm-Leach-Bliley Act. Some examples of that are:

Goals PCI DSS Requirements
Build and Maintain a Secure Network and System
  • Install and maintain a firewall configuration to protect cardholder data
  • Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data
  • Protect stored cardholder data
  • Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program
  • Protect all systems against malware and regularly update anti- virus software or programs
  • Develop and maintain secure systems and applications
Implement Strong Access Control Measures
  • Restrict access to cardholder data by business need to know
  • Identify and authenticate access to system components
  • Restrict physical access to cardholder data
Regularly Monitor and Test Networks
  • Track and monitor all access to network resources and cardholder data
  • Regularly test security systems and processes
Maintain an Information Security Policy
  • Maintain a policy that addresses information security for all personnel

The Self-Assessment Questionnaire (SAQ) is a validation tool for eligible organizations who self-assess their PCI DSS compliance and who are not required to submit a Report on Compliance (ROC).

3 steps to PCI Compliance

For most merchants, that only accept cards but use a 3rd party processor such as Square or Toast, they can typically achieve compliance in a 3 simple steps.

Create & Implement

- Information Security Policy
- Access Control Policy
- Data Destruction Policy

Complete Self Assessment Questionnaire

Complete Attestation of Compliance

Security Control and Processes for PCI DSS

The goal of PCI DSS is to protect cardholder data. The security controls and processes required are vital for protecting all payment card account data. Merchants must never store sensitive authentication data. This includes the 3- or 4- digit security code, the data stored on a card’s magnetic stripe or chip, and PIN entered by the cardholder.

Complying with PCI DSS

PCI DSS applies to merchants and other entities that store, process, and/or transmit cardholder data. While the Council is responsible for managing the data security standards, each payment card brand maintains its own separate compliance enforcement programs. Each payment card brand has defined specific requirements for compliance validation and reporting, such as provisions for performing self- assessments and when to engage a QSA.

Depending on an entity’s classification or risk level (determined by the individual payment card brands), processes for compliance usually follow these steps:

Scope – determine which system components and networks are in scope for PCI DSS.

Assess – examine the compliance of system components in scope following the testing procedures for each PCI DSS requirement.

Report – assessor and/or entity completes required documentation (e.g. Self-Assessment Questionnaire (SAQ)), including documentation of all compensating controls.

Attest – complete the appropriate Attestation of Compliance (AOC).

Submit – submit the SAQ, ROC, AOC and other requested supporting documentation.

Remediate – if required, perform remediation to address requirements that are not in place, and provide an updated report.

Using the Self-Assessment Questionnaire (SAQ)

saq scan
The “SAQ” is a validation tool for merchants and service providers to report the results of their PCI DSS self-assessment, if they are not required to submit a Report on Compliance (ROC). The SAQ includes a series of yes-or-no questions for each applicable PCI DSS requirement. If an answer is no, the organization may be required to state the future remediation date and associated actions. There are different SAQs available to meet different merchant environments.
https://tinyurl.com/rpynwdb8
IRS WISP Guide

Find how Cyber Gryphon can help you become compliant, InExpensively!

Schedule Demo