Table of Contents
Who is the Gap Analysis Aimed At?
URM’s PCI DSS gap analysis service is aimed at those organisations which are looking to benchmark their current corporate information security practices (relating to payment card data) against the Standard and understand their readiness for a c
The gap analysis is often the first step of a PCI DSS project and provides you with a roadmap for achieving compliance.
This service will typically involve one of URM’s QSAs spending time on your site or meeting remotely with those individuals responsible for:
- The PCI DSS programme
- Network administration and cardholder systems
- Developing company policies and procedures
Focus of Gap Analysis
URM’s QSA will assess your organisation’s practices against the 12 high-level PCI DSS requirements as follows:
- Install and maintain network security controls
- Apply secure configurations to all system components
- Protect stored account data
- Protect cardholder data with strong cryptography during transmission over open, public networks
- Protect all systems and networks from malicious software
- Develop and maintain secure systems and software
- Restrict access to system components and cardholder data by business ‘need to know’
- Identify users and authenticate access to system components
- Restrict physical access to cardholder data
- Log and monitor all access to system components and cardholder data
- Test security of systems and networks regularly
- Support information security with organisational policies and programs
Gap Analysis Outputs
The key output from our PCI DSS gap analysis service will be a report that includes:
- A definition of your cardholder data environment (CDE) and in-scope business processes, applications, devices, networks, facilities and service providers
- An assessment of how closely your organisation meets each of the PCI DSS requirements
- Recommendations for reducing the scope of the CDE, where applicable, thus reducing the potential cost of compliance
- Detailed recommendations for remediating any areas of non-compliance
- Advice regarding your organisation's best options for achieving PCI DSS compliance quickly and cost-effectively, drawing upon our QSAs’ experience working with similar organisations.
Do you need support in meeting your annual PCI DSS penetration testing requirements? CREST-accredited URM can complete internal and external penetration tests for your organisation.
As a CREST-accredited penetration testing organisation, URM can complete internal and external penetration tests.
As a long-established PCI QSA, URM is able to deliver a full PCI QSA-led audit and produce a report on compliance (RoC) as well as deliver a full QSA-led self-assessment questionnaire (SAQ)
Everything you need to know about PCI DSS v4.0: With a particular focus on some of the more challenging requirements such as MFA and payment page scripts.
While it’s one of the areas that IT and security departments find challenging, documentation (and compliant evidence)....
In this blog, we address one of the big questions facing organisations which accept payment cards....