PCI

Which PCI SAQ Do I Need?
Which of the nine Payment Card Industry Data Security Standard (PCI DSS) Self-Assessment Questionnaires (SAQs) your organization needs to fill out and submit depends on several factors:

How you process credit-card transactions. Do you outsource these transactions to a third party to process, or do it yourself?
What type of payment processing machine or terminal you use for credit and debit card transactions.
Whether you accept payments in-store from customers with a physical card or phone-pay application, or are strictly e-commerce only.

What is an SAQ, and what is it for?
PCI DSS Self-Assessment Questionnaires (SAQs) are tools provided by the PCI Security Standards Council (PCI SSC) to help payment-card-processing merchants and service providers measure their own PCI compliance Payment Card Industry Data Security Standard (PCI DSS) Self-Assessment Questionnaires (SAQs).
Organizations that are not required to procure an on-site audit by a Qualified Security Assessor (QSA) or Internal Security Assessor and the resulting Report on Compliance (ROC) are permitted, instead, to self-assess. SAQs contain two components:

Questions correlating to the PCI DSS requirements
An Attestation of Compliance (AOC), to be filed with your acquiring bank

Which SAQ is right for my organization?
The PCI SSC has developed eight merchant SAQs and one for service providers. The PCI DSS 3.2.1 SAQ types and their intended users are:

SAQ A: For merchants doing business remotely (e-commerce, mail order, telephone order) that have outsourced payment card data processing and storage to a PCI DSS-validated third party, and do not store card or cardholder data in any form.
SAQ A-EP: For e-commerce merchants that have outsourced credit card data processing and storage to a PCI DSS-validated third party but also maintain a website that doesn’t receive cardholder data but could affect the security of a payment transaction.
SAQ B: For merchants conducting sales in person using credit card imprint machines or standalone, dial-out terminals that do not store cardholder data electronically.
SAQ B-IP: For card-present merchants conducting sales in person using only standalone, PIN Transaction Security (PTS)-approved card payment terminals with an internet protocol (IP) connection to the payment processor, and that do not store electronic cardholder data.
SAQ C-VT: For merchants who manually enter a single transaction at a time via a keyboard into an Internet-based, virtual payment terminal solution that is provided and hosted by a PCI DSS-validated third-party service provider. SAQ C-VT merchants may not store electronic cardholder data.
SAQ C: For merchants conducting sales in-person using payment application systems connected to the Internet. SAQ-C merchants do not store electronic cardholder data.
SAQ P2PE: For merchants using only hardware payment terminals included in and managed via a validated, PCI SSC-listed Point-to-Point Encryption (P2PE) solution, with no electronic cardholder data storage. Not applicable to e-commerce channels.
SAQ D for Merchants: For all merchants not included in descriptions for the above SAQ types.
SAQ D for Service Providers: For all service providers defined by a payment brand as eligible to complete an SAQ.

If your organization processes, stores, or transmits payment card information and you are not required to obtain an on-site audit and ROC, you must complete an SAQ and submit it with an AOC to your acquiring bank.

How to Save Time and Money on your SAQ
PCI DSS SAQ forms can be lengthy and laborious to fill out, costing your organization time, money, and other valuable resources. This is especially true if you are using spreadsheets to track your PCI compliance efforts, and gathering documentation from disparate sources such as email accounts, mail correspondence, website materials, and text messages.

To ease the self-assessment task and save time and money, why not try a compliance software? ZenGRC can, among other things:

Help you minimize the scope of your cardholder data environment (CDE)
Probe your systems and networks to see where you comply with PCI DSS and where you don’t
Tell you what you need to do to reach compliance
Provide a user-friendly overview of your PCI compliance posture on our “single source of truth” dashboard
Collect and keep the audit-trail documents you need
Survey and monitor your third-party service providers’ compliance
Continuously monitor your ongoing PCI DSS compliance

Isn’t it time you ditched your confusing, old-fashioned spreadsheets for a complete, easy-to-use compliance solution? Call a ZenGRC expert today, and take your first step on the worry-free path to PCI DSS compliance—the Zen way.

How to Become PCI DSS Certified

ZenGRC Team · July 29, 2019 ·

How to Become PCI DSS Certified

The short answer to the question of achieving PCI DSS certification is: you can’t.
There is no certificate attesting to Payment Card Industry Data Security Standard (PCI DSS) compliance. There is, however, a way your organization can stand apart as being especially committed to credit card security.

Instead of submitting the self-assessment questionnaire (SAQ) and Attestation of Compliance to your acquiring bank, you may choose to pass an on-site audit by a PCI Security Standards Council-certified Qualified Security Assessor (QSA) or your own Internal Security Assessor, and have them file a Report on Compliance (ROC).

The difference between these two alternatives is vast. With an SAQ and AOC, your enterprise is assessing itself. An ROC, however, attests that a qualified professional auditor has thoroughly examined your cardholder data environment (CDE) and, if necessary, your entire network and all your systems. The ROC will indicate whether the auditor found your organization to be PCI DSS compliant.

ROC vs. AOC: Which Do You Need?

The PCI Security Standards Council (PCI SSC), a consortium of five major credit card brands (Visa, Mastercard, American Express, Discover, and JCB) created PCI DSS to govern the security of payment card and cardholder data. The framework comprises 12 requirements and 281 directives that spell out precisely what merchants and service providers that accept, process, store, or transmit credit or debit card data must do to comply.

But security risks differ from enterprise to enterprise. Large entities that process millions of card transactions per year face a much greater chance of data breach than mom-and-pop shops. Recognizing this difference, the PCI SSC established four compliance levels for merchants and two for service providers.

In both categories, only those qualifying as Level One must pass an on-site audit and submit a Report on Compliance. Those in Levels 2, 3, and 4 may self-assess and submit an Attestation of Compliance.

Which level your organization qualifies for depends partly on the number of transactions processed, and partly on which payment cards you accept. Each credit card company defines the compliance levels slightly differently.

Generally speaking, if you’re a merchant processing more than 1 million transactions e-commerce and in-store per year, you may be considered Level 1. If you’re a service provider handling the credit card data of more than 300,000 cards per year, you qualify in all instances as Level 1.

If your enterprise has experienced a data breach that resulted in the compromise of credit card or cardholder data, however, you must meet Level 1 requirements no matter what your organization’s size.

Why Should You Choose an ROC?

An ROC will almost certainly be more costly to procure than an AOC, especially if you need to hire a QSA to audit your systems and networks. The price varies depending on several factors including the size of your organization and how many IP addresses it maintains.

But the larger your enterprise, the more likely your acquiring bank will be to require you to meet Level 1 requirements. Even if it doesn’t, however, you might still want to pursue an ROC to outshine your competitors. It isn’t certification, per se, but it’s the PCI DSS equivalent of getting certified.

Admittedly, the price of an audit—as much as $50,000 for larger entities—can be prohibitive, especially if you’re using old-fashioned, clunky spreadsheets to track your organization’s PCI DSS compliance efforts and trying to gather documentation from a variety of sources.

Cheaper, easier PCI compliance

There are things you can do to reduce those costs. Our handy PCI audit ebook provides tips for streamlining your PCI DSS compliance efforts to make the job much easier for the SAQ or internal assessor, and much more cost effective for you.
But the number-one way to sail through a PCI DSS audit with ease is to ditch your spreadsheets. A quality governance, risk and compliance tool can make PCI compliance a snap. What’s not to like?

ZenGRC provides PCI DSS compliance assistance to some of the world’s leading companies. Our fast and easy deployment, “single source of truth” dashboards, vendor monitoring, document collection and storage, in-a-click internal audits and other features will take you all the way to PCI DSS compliance and keep you there, year after year.

Your PCI DSS success assured, you’ll be free to relax and focus on the task at hand: keeping your customers and clients happy, and growing your profits. Worry-free compliance is the Zen way. Why not contact a ZenGRC specialist today?

PCI DSS: Testing Controls and Gathering Evidence

ZenGRC Team · July 18, 2019 ·

Compliance with the Payment Card Industry Data Security Standard (PCI DSS) is not easy to achieve. Quite the opposite, in fact: A 2017 Verizon report stated that 80 percent of companies fail their PCI DSS assessments, and only 29 percent of those that pass are still compliant after one year.

PCI DSS compliance, like information security as a whole, is not a one-and-done process but ongoing. To succeed, your enterprise must be vigilant.

And comply you must, if your organization wants to do business. Penalties for non-compliance can be high—even crippling— but never fear. With planning and preparation, you can obtain that coveted Report on Compliance (ROC) or Attestation of Compliance (AOC) with relative ease.

Here’s how: Before every PCI DSS audit or self-assessment, you must test the controls around your cardholder data environment (CDE), remediate issues, and collect evidence that those security policies are working as they should.

Best practices for staying in PCI DSS compliance include:

Frequent testing of organizational system and security controls
On-site audits or assessments every year
Quarterly scans of your systems by an Approved Scan Vendor (ASV)
Documentation of your enterprise’s policies, procedures, and activities involving the processing, storage and transmittal of credit card information or cardholder data.
Documentation of your systems and controls testing.

Once you’ve completed these steps, present the test results and other evidence of your PCI compliance efforts to the Qualified Security Assessor (QSA) performing your audit. Otherwise, your organization may face:

A bigger-than-necessary audit bill as the auditor has to run the tests and collect the evidence themselves
Costly fines for non-compliance if you fail your audit or self-assessment. Testing and remediation will greatly increase your chances of obtaining your Record of Compliance or validation.
The loss of your enterprise’s ability to accept credit card payments—a crippling blow for any business

Even if you have run these tests before, you will need to do so again before each audit. The evidence you provide showing that you meet PCI DSS requirements must be current.

What is PCI DSS, and Why Does It Matter?
Established by the PCI Security Standards Council (PCI SSC), a consortium led by credit card companies Visa, Discover, JCB, Mastercard, and American Express, PCI DSS is a set of data security standards that all merchants and service providers must meet if they process credit card data.

The framework aims to secure credit card and cardholder data from a data breach. Acquiring banks, which are the financial institutions that process credit card transactions, demand continuous compliance from merchants and entities that provide certain services to those merchants.

To meet the stringent requirements, regularly testing the security of your payment systems end-to-end is key.

How Do I Test Controls and Gather Evidence?
The controls you must test will center on the security of your entire payment card transaction network: the point-of-sale system, the application that processes payment information, where and how the information is stored, the network security of routers transmitting the information, how sensitive data is encrypted, and more.

Risk assessment provides a critical foundation for PCI DSS compliance. Assessing risk organization-wide will help you to establish the most secure environment for credit card and cardholder data protection. Make sure that the assessment specifically addresses credit card data risk, and that remediation is documented.
The PCI DSS requirements, 281 of them in 12 categories, spell out prescriptively how to put in place the controls your organization needs to comply with the framework. The directives address encryption—specifying, for instance that you should be using Transport Layer Security (TLS) rather than the outmoded Secure Socket Layer (SSL); network segmentation; third-party vendor security; security awareness training, and data disposal, among many other components of a functioning security program.
Penetration testing, either by an internal employee or an independent, qualified third-party, is required throughout the CDE. The testing includes vulnerability scans, and finds gaps in your payment card system’s security and processes.
Segmentation testing, required annually if your organization segments its CDE from the rest of its network, is a part of penetration testing. Its goal is to verify that segmentation methods are working efficiently, and to isolate CDE systems from those that are out of scope.

Once you have tested and verified that your controls are working, you will need to prepare an audit trail of documents demonstrating your efforts at PCI compliance. Documentation may include emails, system and network logs, policies, procedures, protocols, network configurations, system architectures, and any other written materials that show how your CDE’s security is protected.

Get Help if You Need It
The road to PCI DSS compliance can be long and arduous: at least two years for bigger companies and a year or more for smaller ones. If you’re using old-fashioned spreadsheets to keep track of all the directives and where you measure up (and don’t), you’re doing it wrong.

In today’s digital business world, there’s a much better way to become PCI DSS compliant.

ZenGRC, our user-friendly software as a service, scans your systems against the hundreds of PCI DSS directives and shows where your enterprise complies and where it falls short on an easy-to-read “single source of truth” dashboard.

ZenGRC lets you audit your CDE with just a few clicks, as often as you like, enabling you to remediate problems and close compliance gaps before your official, on-site audit or self-assessment begins.

ZenGRC also generates, stores, collects, and organizes all the documentation you’ll need at audit time. This leaves you free to work on keeping your systems and networks secure, and your clients and customers happy.

Worry-free, hassle-free PCI DSS compliance: that’s the Zen way. Book a demo with a ZenGRC expert today for your free consultation.

What Is a PCI Audit?

ZenGRC Team · July 11, 2019 ·

What is a PCI Audit?

A PCI audit examines the security of your organization’s credit-card processing system from beginning to end.

During this process, a Qualified Security Assessor (QSA) or your own Internal Security Assessor will determine the effectiveness of your organization’s information security controls. To pass the test, your payment network must meet as many as 281 criteria spelled out in the Payment Card Industry Data Security Standard, or PCI DSS, with which all merchants and their service providers must comply.

To demonstrate PCI compliance, your organization must do one of two things:

Have an on-site audit by a Qualified Security Assessor (QSA) or Internal Security Assessor, or
Fill out a PCI DSS self-assessment questionnaire, which may or may not involve an internal audit.

Which scenario applies to you? The answer depends in large part on the number of credit card transactions your enterprise processes yearly. The more transactions you process, the greater the likelihood that you will need an annual audit and Record of Compliance (ROC) to satisfy the requirements of this crucial security framework.

Why PCI DSS Matters
The PCI Security Standards Council (PCI SSC), representing financial institutions, merchants, processor companies, software developers, and point-of-sale vendors, established PCI DSS to help prevent breaches of credit card and cardholder data.

The framework’s origins date to 1999, when Visa developed a Cardholder Information Security Program in response to rampant increases in credit card fraud via the (brand new) Internet. In 2004, the five major credit card brands jointly launched the first version of this framework, PCI DSS 1.0.

To accept credit-card payments today, all merchants and payment and internet service providers (ISPs) must demonstrate an ongoing and continual commitment to protecting credit card and cardholder data from unauthorized access and use.

Which Level Are You?
Recognizing that not all merchants or their service providers are created equal, the PSI SSC established four compliance levels for merchants and two for ISPs. The higher the level, the more stringent the PCI DSS requirements.

To comply with PCI DSS, Level 1 merchants and ISPs must attain the ROC, which involves an audit. Those in levels 2, 3, and 4 may self-assess by filling out PCI DSS Self-Assessment Questionnaire (SAQ) that the security standards council provides. A quality GRC software or service can make either task much easier and cost-efficient.

Which level your organization belongs to depends on:

Which credit cards you accept, and
How many transactions you process in a year.

Level 1 merchants process 1 to 6 million transactions yearly; Level 1 service providers process 300,000 per year.

What is a PCI DSS audit?
To attain your ROC, you must procure an on-site audit from an external Qualified Security Assessor (QSA) or your organization’s own Internal Security Assessor. With 12 objectives and 281 directives to comply with, your initial audit can take as long as two years to complete. Self-assessing, while not as time-consuming, can take one year.

The audit or assessment involves testing all your organization’s controls around the Cardholder Data Environment (CDE): point-of-sale system; access (including physical access) to the CDE; your vendors’ data security; network segmentation; the application that processes payment information, where and how card information is stored, security of the routers transmitting the information, data encryption, and more.

The good news is that PCI DSS is highly prescriptive. It tells you what you need to do to comply with each directive. And not every requirement applies to every organization, so yours might have fewer than 281 requirements to meet.

As you prepare for your audit or self-assessment, taking the following steps can speed the process and reduce your costs:

Define your scope. Sit down with the framework and decide which directives apply.
Minimize your scope. Simply placing firewalls around your Cardholder Data Environment , among other things, can reduce your vulnerability to cybercrime and limit the systems the auditor will need to examine.
Determine how well you meet each applicable PCI DSS requirement. Your risk assessment document may help with this step. Where you do not comply, apply needed controls.
Test your controls. Do this before each yearly audit or assessment. PCI DSS compliance is an ongoing process, requiring constant vigilance.
Gather your evidence. Audits are all about documentation; have yours ready for the auditor.

With credit card fraud and data breaches always on the rise, these steps make sense for any organization wanting to make ironclad their credit card data security.

Get Help if You Need It
Complying with hundreds of requirements can be a time-consuming and frustrating task—more so if you’re using spreadsheets to track your progress.
Fortunately, there is a better way. A quality tool such as ZenGRC can make PCI DSS compliance easier, faster, and more complete. Our unique solution provides “single source of truth” dashboards with overviews of your compliance and risk posture; the documentation your auditor or self-assessor needs, easy-to-implement self-audits, and more.

Worry-free compliance and hassle-free audits are the Zen way. Contact a ZenGRC expert today and breathe easier, knowing the path to PCI DSS compliance will be smoother for your organization.