Tag Info

New answers tagged

1

Yes, in certain situations. https://www.pcicomplianceguide.org/pci-faqs-2/#11 Q: Do I need vulnerability scanning to validate compliance? A: If you qualify for certain Self-Assessment Questionnaires (SAQs) or you electronically store cardholder data post authorization, then a quarterly scan by a PCI SSC Approved Scanning Vendor (ASV) is ...


1

If you are in a position whereby you can self-assess, you could lie an respond that all requirements are fully in place. Typically, your acquirer will request a copy of your SAQ and the signed Attestation of Compliance. It is unlikely that additional evidence will be required. A self-assessment is just that; an internal review of your own processes and ...


5

If you don't provide documentation of your compliance (either an SAQ or your AoC and RoC) to your processor/acquirer, they stop processing transactions for you, which is sort of like a fine in that you start losing money and customers. To quote the overview to the PCI DSS Self-Assessment Questionnaire (SAQ), you may be required to share [your SAQ] ...


2

Short version: You seem to be A-EP You seem to be A, based on the specific products referenced, but you should ask your processor(s) to be sure. If by "Amazon Payments JavaScript widget" you mean Amazon Express Checkout, then you're SAQ A-EP, because "elements of the payment page originate from the merchant website". Amazon Payments "Login and Pay" is jut ...


0

No organization's objective is "security." The purpose of sensitive information is not its own existence, but its application to organizational objectives. This is to say that any effort in security takes away from real organizational objectives - it's detrimental. That said, let me follow your question directly. With a question: "Strict" in what way? It ...


5

There are a lot of complex issues, mainly related to effort and trust dynamics, that undermine security policies in organisations. Whilst individual factors have been uncovered by researchers, there isn't as of yet a single unified theory of what security management styles are preferable or of what policies to implement in every single organisation. The ...


11

What you are pointing is the difference between imposing security rules to people and involving people to get better security. Chances are that you will find this video quite interesting. After a walk through issues quite similar to the one you mention, the presenter (Jayson E. Street to name him) ends up by talking about positive enforcement. It makes the ...


0

There is a great guide on "How to Become HIPAA Compliant" at http://accountablehq.com/guides.html This Smart Guide gives a detailed account for how to achieve HIPAA compliance and is a free resource available to anyone. Hope this helps! Disclosure: I'm the founder of Accountable, a software company that focuses on making HIPAA compliance easy.



Top 50 recent answers are included