PCI DSS
PCI DSS Compliance and Certification Services
Seniors IT offers the following standardized methodology of PCI Certification for all its clients year 1. The methodology consists of the following steps:
Gap Analysis (Steps 1 to 3):
Seniors IT will perform a gap analysis and perform the required testing to be able to inform the client of the controls that need remediation to achieve PCI compliance. The assessment will include a review of the cardholder production network (including vulnerability and penetration testing) and supporting technical documentation. The assessment process may include interviews with company personnel to determine what PCI requirements are in place and where remediation is required.
The first phase of the project will involve reviewing and validating the current cardholder network environment, policies and procedures against the PCI Data Security Standard (DSS). The methodology for validation will include:
- Review of current cardholder environment technology and security features
- Mapping touch points to the corporate network
- Examining access points and network components for security shortcomings from a PCI perspective
- Verification that current documented controls meet the specific PCI DSS requirements
- Scans and penetration tests to validate that the client has attained an appropriate level of security
For this phase, Seniors IT consultants will require the following documentation from the client
- Current network diagrams of the appropriate environments with respect to cardholder data
- Firewall/router configuration details
- Data retention and disposal procedures
- Policy and Procedures for physical security
- Encryption Key Management Policy
- Incident Response Policy
- Password Policy
- Change Control Policy
- Build/Patch Policy
- Internal Security Testing Procedures
Seniors IT will provide standard templates for the above mentioned policies and procedures, if so desired by the client.
Remediation plan and support (Steps 4 & 5):
Certification (Steps 6 to 9):
| MerchantsLevel 1 | Level 2 | Level 3 and Level 4 | |
| PCI Assessment Type | Annual Onsite Assessment | Annual Self-Assessment | Payment Brand or Acquirer Defines What is Required |
| Reporting | ROC and Quarterly ASV Scan | SAQ and Quarterly ASV Scan | Payment Brand or Acquirer Defines What is Required |
| Service Providers | Level 1 | Level 2 | Level 3 (American Express) |
| PCI Assessment Type | Annual Onsite Assessment | Annual Self-Assessment | Annual Self-Assessment |
| Reporting | ROC and Quarterly ASV Scan | SAQ and Quarterly ASV Scan | SAQ and Quarterly ASV Scan |
