PCI DSS (Payment Card Industry Data Security Standard)) Compliance Assessment
PCI compliance is adherence to the set of policies and procedures developed to protect credit, debit and cash card transactions and prevent the misuse of cardholders' personal information. All card brands require compliance with the Payment Card Industry Data Security Standard (PCI DSS).
Performing a PCI DSS compliance assessment, or validating compliance, is the process of evaluating an organization's security policies, procedures and network configurations against each applicable control in the standard.
Navigate to Company Level > Compliance > Assessments > PCI DSS section to use the default template to start with PCI DSS Assessment.
Click on Default Template to create your assessment for PCI DSS. The assessment is divided into 24 sections. Every section has a set of questions to be answered for this assessment. Few of the answers will be auto-populated based on CyberCNS scans that are successfully completed.
Click on Add to create a new PCI DSS Assessment.
To start with please provide the Assessment Name of your choice. The current assessment will be stored by this name.
In this assessment, there are 24 sections. Below are the different sections with descriptions which will be used for the assessment:
Merchant Organization Information.
Qualified Security Assessor Company Information (If Applicable): QSA, is a security company that has been certified by the PCI Security Standards Council (SSC) to perform PCI DSS assessments.
Executive Summary: This captures information about Merchant Business and Types of Payment Channels used by the organization.
Description Of Payment Card Business And Locations: In what capacity does the business store, process, and/or transmit cardholder data & locations.
Payment Application And Description Of Environment: Information regarding the Payment Applications used by the organization.
Third-Party Service Providers And Eligibility To Complete SAQ: Company sharing cardholder data with any third-party service providers details.
Requirement 1: Install And Maintain A Firewall Configuration To Protect Data.
Requirement 2: Do Not Use Vendor-Supplied Defaults For System Passwords And Other Security Parameters.
Requirement 3:Protect Stored Cardholder Data.
Requirement 4: Encrypt Transmission Of Cardholder Data Across Open, Public Networks.
Requirement 5: Protect All Systems Against Malware And Regularly Update Anti-Virus Software or Programs.
Requirement 6: Develop and Maintain Secure Systems And Applications.
Requirement 7: Restrict Access To Cardholder Data By Business Need To Know.
Requirement 8: Identify And Authenticate Access To System Components.
Requirement 9: Restrict Physical Access To Cardholder Data.
Requirement 10: Track and Monitor All Access To Network Resources And Cardholder Data.
Requirement 11: Regularly Test Security Systems And Processes.
Requirement 12: Maintain A Policy That Addresses Information Security For All Personnel.
Appendix A: Additional PCI DSS Requirements.
Validation And Attestation Details.
Merchant Attestation.
QSA Acknowledgement (If Applicable).
ISA Acknowledgement (If Applicable)
Action Plan For Non-Compliant Requirements.
Once all the details are provided click on Save and click on Next for the next page.
For every question in the assessment, evidence can be uploaded using Upload Evidence, once the assessment is saved in the draft mode.
Assessment Status
You can ONLY View/Download an assessment while it is in a COMPLETED status.
You can ONLY Edit an assessment while it is in DRAFT status.
Action options include: Edit, View/Download, and Delete.
Edit: Continue with updates/edits to an open assessment.
Delete: permanently deletes the assessment.
View/Download: Start the ZIP file download containing three files (DOCX, XLSX, and Evidence folder containing individual XLSX files with the answer/evidence collected by CyberCNS Scan during the assessment).
When downloading the ZIP file, the name is using ‘Company Name _ Assessment Name _ Date _ Time’.
Example of the three file outputs as mentioned above.
Example of the individual evidence output inside the ‘evidence’ folder.
This completes PCI DSS Compliance Assessment document.