PCI DSS Compliance

The standard comprises twelve major requirements, which are further grouped under six related 'control objectives' as shown below:

1. Build and Maintain a Secure Network
   Requirement 1: Install and maintain a firewall configuration to protect cardholder data
   Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters
2. Protect Cardholder Data
   Requirement 3: Protect stored cardholder data
   Requirement 4: Encrypt transmission of cardholder data across open, public networkss
3. Maintain a Vulnerability Management Program
   Requirement 5: Use and regularly update anti-virus software
   Requirement 6: Develop and maintain secure systems and applications
4. Implement Strong Access Control Measures
   Requirement 7: Restrict access to cardholder data by business need-to-know
   Requirement 8: Assign a unique ID to each person with computer access
   Requirement 9: Restrict physical access to cardholder data
5. Regularly Monitor and Test Networks
   Requirement 10: Track and monitor all access to network resources and cardholder data
   Requirement 11: Regularly test security systems and processes
6. Maintain an Information Security Policy
   Requirement 12: Maintain a policy that addresses information security

More information is available at: https://www.pcisecuritystandards.org

The process we use can be briefly outline as follows:

1. Minimise the PCI-DSS Footprint: As the PCI DSS only applies to network and application infrastructure that transmit or store credit card data elements, the first priority for MTI will be to analyse and make recommendations to shrink to the 'in-scope' component of the network and application infrastructure to its smallest practical footprint in order to reduce the PCI compliance footprint and the associated costs.
2. Select the Correct SAQ and Validate the Assessment Output: Once the PCI DSS 'in scope' environment is minimised, MTI will assist your organisation to determine which self-assessment questionnaire (SAQ) is applicable, facilitate the collection of data required against the SAQ and then validate the output thereof against the requirements of the standard.
3. Develop a Remediation Roadmap: MTI will work with your organisation to develop a 'roadmap to compliance' which, when implanted, will leave your organisation fit and ready for a QSA to conduct a PCI DSS Compliance audit and sign off your compliant status.

Larger organisations that handle cardholder data are required by the PCI to have their compliance assessments carried out by a PCI Qualified Security Assessor (QSA). QSAs have undergone training and examination and have been certified by the Council to validate an entity's adherence to the PCI DSS.

As a QSA certified company, MTI is in a postion to help and advise organisations of all sizes to the highest standards.