The best way to maximize security of cardholder data is to continuously monitor and enforce the use of controls specified in the PCI Data Security Standard.
Many organizations treat compliance as a one-time, annual event. But only focusing on an annual compliance assessment can create a false sense of security.
Forensic investigators have discovered that security controls deployed by organizations that had passed an assessment were often out of compliance when breaches occurred at a later date. It’s only by achieving and maintaining compliance that your cyber defenses will be adequately primed against attacks aimed at stealing cardholder data.
Validation of compliance with the PCI Data Security Standard is determined by individual payment brands. All have agreed to incorporate the PCI Data Security Standard as part of the technical requirements for each of their data security compliance programs. The payment brands also recognize qualified security assessors and approved scanning vendors qualified by the PCI Security Standards Council.
The Council does not enforce compliance; this is done by individual payment brands or acquiring banks.
Specific questions about compliance validation levels and what you must do to validate should be directed to your acquiring financial institution or payment card brand.
Learn more:
Implementing the PCI Data Security Standard starts with scoping. This process involves identifying all system components that are located within or connected to the cardholder data environment (such an environment is comprised of people, processes, and technology that handle cardholder data or sensitive authentication data).
Scoping is an annual process and must occur prior to the annual assessment. Merchants and other entities must identify all locations and flows of cardholder data to ensure all applicable system components are included in scope for the PCI Data Security Standard.
A Qualified Security Assessor is a data security firm that is qualified by the PCI Council to perform on-site PCI Data Security Standard assessments.
The Assessor will:
See a list of all Qualified Security Assessors
View ListAn Approved Scanning Vendor is a data security firm that uses a scanning solution to determine whether or not the customer meets the external vulnerability scanning requirement. Approved Scanning Vendors are qualified by the PCI Security Standards Council to perform external network and system scans as required by the PCI Data Security Standard.
See a list of all Approved Scanning Vendors
View ListReports are the official method by which merchants and other entities report their compliance status with the PCI Data Security Standard to their respective acquiring financial institutions or payment card brand.
Quarterly submission of a report for network scanning may also be required. Individual payment card brands may require submission of other documentation; see their web sites for more information.
Depending on payment card brand requirements, merchants and service providers may need to submit a Self-Assessment Questionnaire for self-assessments, or a Report on Compliance for on-site assessments.
Learn MoreOur website uses both essential and non-essential cookies (further described in our Privacy Policy) to analyze use of our products and services. By clicking “ACCEPT” below, you are agreeing to our use of non-essential cookies to provide third parties with information about your usage and activities. If you click “DECLINE” below, we will continue to use essential cookies for the operation of the website.