Search Results

I don't have any specific resources to point to because, for better or worse, the PCI council typically defers to QSAs rather than attempting to cover each scenario that an organization my encounter. …

This is a common question. It is helpful to know exactly what the QSA has to attest to as required by the PCI council. Use the following document as your guide: https://www.pcisecuritystandards.org/d …

Technically, all systems on the same network as the POS workstation are in scope. Any system on a network segment where cardholder data is stored, transmitted, or processed is in scope, not just the s …

SAQ A is the most applicable, which is defined as " Card-not-present Merchants, All Cardholder Data Functions Outsource". In all honesty, they can sign their name to any of the SAQs because without s …

PCI compliance is a good baseline no matter what you are trying to protect. If you are talking about an environment that has sensitive data (credit card, Social Security, or other), if you treat that …

A PCI ASV scan is a black box test. It is meant to certify a minimum level of security which you must achieve to receive passing results (and be considered 'PCI Compliant'). The web crawling portion i …

There may be a more custom solution out there, but I find that an easy-to-use internal wiki is usually the best approach. It allows many users to update the policies, provides version control, and all …

I think you have a good approach. I find it interesting that users would complain about not being able to immediately identify card numbers when they can view the first six AND last four in your resul …

It doesn't sound like your company has been through a PCI DSS on-site assessment before or even tried to answer all of the questions in the SAQ D. For almost every company that has, they are looking f …

If your systems touch the cardholder data during transmission but you don't store any data, you will be an SAQ C. For more guidance on determining you SAQ type, see the PCI DSS SAQ Instruction Guide …

Your reference to software patches, network diagrams, and end-of-life dates is true with regards to the PCI DSS as a whole, but there are very specific and relevant requirements regarding your questio …

Cardholder name, 4 last digits of CC number and its expiration date are all NOT sensitive data. The cardholder name and expiration date only require protection if you are storing them with the full pr …