PCI Data Security Standard

PCI Data Security Standard: Ensuring Trust in Digital Transactions

In the digital age, where online commerce is increasingly prevalent, the protection of sensitive payment information has never been more crucial. The Payment Card Industry Data Security Standard (PCI DSS) represents a comprehensive set of security standards designed to ensure that all companies accepting, processing, storing, or transmitting credit card information uphold the highest standards of data security.

ProCheckUp's Legacy in PCI Compliance:
ProCheckUp prides itself on being at the forefront of payment security. We are not only a founding Qualified Security Assessor (QSA) and Approved Scanning Vendor (ASV) member of the PCI Security Standards Council (PCI-SSC) but existed as an VISA QSA and VISA data approved scanner, even before the formal establishment of the PCI-SSC. This rich legacy affords us a unique perspective and deep expertise in navigating the complexities of PCI DSS compliance.

Assessment Levels:
Your assessment level, whether as a service provider or merchant, depends on various factors. You may be required to complete a self-assessment questionnaire (SAQ) or undergo a full Report on Compliance (ROC). Our team is adept at identifying the precise needs of your organization, ensuring a seamless and efficient assessment process.

Why Partner with ProCheckUp?
Achieving and maintaining PCI Compliance can be a complex journey. At ProCheckUp, we offer more than just compliance services; we establish an embedded partnership. Our approach ensures that your projects impacting PCI DSS compliance are handled effectively, minimizing disruptions and aligning with the best security practices. Let us guide you through every step of the process, leveraging our longstanding expertise and commitment to excellence in payment security.

ProCheckUp PCI Solution's

• PCI-ASV (Approved Scanning Vendor) Services: ProCheckup, a globally recognized ASV, conducts meticulous external vulnerability scans to ensure the integrity of systems handling credit card data, in compliance with PCI-DSS requirement 11.3.2. Our ASV scan solution leverages cutting-edge security tools to rigorously test and confirm your network's defenses against known threats, helping to secure your data transactions. (Learn More)
• PCI-QSA (Qualified Security Assessor) Services: As an independent QSA firm accredited by the PCI Security Standards Council, ProCheckup embodies excellence in ensuring entities meet the stringent standards of PCI DSS. Our longstanding expertise, since the establishment of the QSA program, provides reliable validation of your compliance posture. (Learn More)
• Penetration Testing: ProCheckup's penetration testing services are an embodiment of our commitment to security excellence, meeting PCI-DSS requirement 11.4.1. Our team of Crest, Cyberscheme, and NCSC-qualified penetration testers, with a proven 24-year track record since 1999, employs a comprehensive approach to identify and remediate exploitable security vulnerabilities. (Learn More)
• Data Discovery for Primary Account Number (PAN): Our specialized services extend to the detection of PAN within your network, particularly identifying unauthorized storage locations outside the Cardholder Data Environment (CDE), adhering to PCI-DSS requirement 12.5.2. ProCheckup ensures that sensitive payment data is contained and managed securely. (Learn More)
• Segmentation Testing: With precise technical testing, ProCheckUp validates the efficacy of network segmentation, ensuring that the CDE is isolated from all systems not pertinent to card processing , in compliance with PCI-DSS requirement 11.4.5 This critical service supports PCI-DSS compliance by verifying the robustness of segmentation controls, maintaining the security of your cardholder data environment. (Learn More)

Please go to PCI FAQ to find out more information about PCI.

Engagement Lifecycle with ProCheckUp

Scoping

Before an in-depth PCI DSS assessment, it's essential to understand the Card Holder Data environment. We'll engage closely with you to define the scope of assessment, ensuring clarity and precision.This understanding is achieved through a scoping exercise conducted between the client (and any relevant third parties involved), and the PCI DSS consultant who will be conducting the assessment (or a suitably designated person), as well as the ProCheckUp Account Manager. The outcome of this meeting is a PCI DSS scoping document/statement, which lists the specific objective(s) of this assessment. During this phase, the scope of the CDE is validated.

ProCheckUp are proposing to engage with your organisation through a contract where a total number of consultancy days are purchased in advance. This approach delivers several inherent benefits.

After the scoping engagement, ProCheckUp will propose a high-level project plan which defines the number of consultancy days envisaged to meet with the requirement currently being driven by your organisation. It should be noted that the outlined project plan may be liable to changes as the initiation phase proceeds and through any requirements being driven by the acquiring bank once they have been fully understood. 

PCI DSS Implementation

ProCheckUp will work with your organisation to build an implementation plan which will focus on the following phases.

Stage 1 – Pre-compliance Assessment

The pre-compliance assessment will involve understanding the size of the compliance risk to your business, to determine where you stand, and create a compliance programme tailored to your specific requirements. The pre-compliance assessment involves gathering data to identify gaps within your current security posture, PCI DSS and any other security standards where applicable.

The pre-compliance assessment will typically include:

• Conducting an on-site review of IT infrastructure, network design and architecture, application architecture, policies, procedures and processes to determine non-compliant areas.
• Identifying your card holder data environment and determining your card holder data flow, in order to confirm your PCI scope.
• A gap analysis between the pre-assessment of the policies, procedures and processes as well as scan results against both PCI DSS criteria and industry best practice.
• A recommendations report.
• Scoping and prioritising remediation activities.

Stage 2 – Remediation

Based upon the results of the pre-compliance assessment the remediation programme provides a controlled, focused and effective framework towards achieving compliance. Our remediation programme will help your organisation develop, implement and document the evidence required to prove compliance in accordance with PCI DSS Standards. We will look to form close working relationships with not only your organisation but also any additional third party vendors that are involved in delivering hardware, software and services if required. 

Policy Development

Our consultants can assist in developing information security policies, procedures, processes and practices that incorporate your organisation’s specific business requirements and IT environment.  Although we recommend that this is developed within your organisation, we can offer assistance and consultancy in these areas. Our consultancy experience ranges from large multi-channel retailers and financial services organisations to small businesses.

IT Infrastructure Development

ProCheckUp has a wealth of experience in network infrastructure security testing and design, which subsequently means that your organisation will benefit from our technical consultants’ expertise. In addition, we will be able to advise your business on how to design its infrastructure to accommodate PCI DSS requirements, including the effective use of firewalls, intrusion detection and protection and network segmentation. This also extends to POS systems and payment processing environments.

As an independent security advisor, ProCheckUp will be on hand to assist all parties with any remediation that have been highlighted by our findings. Although we do not recommend any specific vendor’s solutions, we do provide advice on the technology that can be used to meet your requirements. We have found that previous customers have utilised our PCI DSS User Group to field any questions on specific solutions or providers. We are also happy to ask on your behalf for direction from the attendees.

Stage 3 – Audit and Report on Compliance

After the remediation phases, ProCheckUp will manage the audit process. This phase will include the production of the Report on Compliance (ROC). For a level 1 merchant, an on-site audit is compulsory and is advisable for level 2 merchants. The QSA will assign a consultant to validate compliance (typically by conducting interviews with key staff), and review the vulnerability scanning and other defined tests as required in the PCI standard.

Stage 4 – Certification

This phase is undertaken by the QSA and includes the submission of all relevant documentation, including the ROC, to the acquiring bank for level 1 merchants, and the certification of the audit report by the card schemes.

Stage 5 – Maintaining Compliance

Achieving compliance is not just a one-off exercise. PCI DSS certification is required annually and vulnerability assessment scanning (ASV) is mandated to be conducted quarterly. Full manual penetration testing must be conducted on an annual basis or after any significant changes. It is vital that any process or technology decisions are taken with PCI DSS compliance in mind. ProCheckUp can manage the overall PCI DSS compliance process, providing programme management from the initial pre-compliance assessment through to certification and ongoing compliance with annual penetration testing, ASV and consultancy.

Following a PCI DSS assessment, ProCheckUp will provide a detailed report via a secure transport mechanism to the agreed recipients.

Established by major credit card companies, PCI DSS is a blueprint for securing payment systems. It emphasizes:

• Secure networks and systems.
• Cardholder data protection.
• Vulnerability management.
• Strong access control.
• Network monitoring and testing.
• Information security policy.

Significance of PCI DSS Compliance:

• Consumer Trust: Assures customers of their card data security.
• Avoid Penalties: Non-compliance can lead to heavy fines.
• Protect Brand Reputation: Prevent data breaches that damage business reputation.

Key Requirements:

• Secure Network: Protect data with firewalls; avoid default passwords.
• Data Protection: Encrypt cardholder data transmission; minimize stored data.
• Vulnerability Management: Use updated anti-virus software; maintain secure systems.
• Access Control: Restrict data access; assign unique IDs.
• Network Monitoring: Test security regularly; monitor data access.
• Information Security Policy: Ensure policies are known and followed.

Steps to Achieve PCI DSS Compliance:

• Scoping and Discovery: Identify all elements involving cardholder data.
• Vulnerability Assessment: Identify weak points through testing.
• Remediation: Address and rectify vulnerabilities.
• Report Compilation: Document compliance steps.
• PCI DSS Validation: Undergo a validation process.

Maintaining Compliance:
Stay compliant through regular audits, continuous monitoring, system updates, and periodic training.

Conclusion

Adherence to the PCI Data Security Standard symbolizes commitment, security, and trust. Businesses showcasing compliance emphasize their dedication to customers' financial security, building a stronger digital trust.