PCI DSS Reduction and Assessment

|
|
|
PUBLISHED on
05
August
2022
SUMMARY

Scope and Applicability Definition

The Payment Card Industry Security Standards Council (PCI SSC) defines scoping as “the process of identifying all system components, people, and processes to be included in a PCI DSS assessment to accurately determine the scope of assessment.”

It is essential that your organisation is able to conduct this process as accurately as possible and an incorrect assessment can lead to security controls being applied above and beyond what is necessary or security controls not being applied to systems that should be in scope of the standard.

URM’s consultants are able to work with you and help determine the correct assessment scope from which you can proceed to analyse the applicability and necessity of each PCI DSS control requirement.

SAQ Selection

In order to assist merchants and service providers validate compliance with the PCI DSS, the PCI SSC has developed and made available a number of self-assessment questionnaires (SAQs), each of which are applicable to a specific payment scenario.

The 9 SAQs are aimed at those qualifying merchants and service providers that are not required to undergo an on-site data security assessment nor submit a report on compliance (ROC).

Choosing the right SAQ is critical, as incorrect submissions can invalidate your compliance and expose your organisation to greater risk of payment card data breaches. The time and effort involved in completing the different SAQs can also vary considerably.

URM’s consultants can assist in advising which SAQ is most applicable to your organisation

They can also provide invaluable assistance in assessing whether there may be opportunity to reduce the scope of your cardholder data environment, resulting in you having to complete a less onerous SAQ.

Scope Reduction

The best and most cost-effective approach to achieving compliance with the PCI DSS is to reduce the scope of your cardholder data environment.

By limiting where card information is held and processed within your organisation, it is possible to both reduce the likelihood of a payment card breach occurring, and also to significantly reduce the costs and efforts of maintaining and validating your compliance programme.

URM’s consultants can advise you on how your PCI DSS scope can be reduced using a variety of techniques and will explain the benefits and drawbacks of the different options available to your unique environment and situation.

All of URM’s proposed scope reductions are totally vendor agnostic and do not involve any specific vendor solutions or technologies.

For organisations that require additional guidance, URM can provide unbiased remediation and solutions advice that leverage existing technology investments.

Are you looking for help preparing for a PCI DSS assessment?

As a PCI QSA, URM can assist you with a range of services, including conducting gap analyses, helping you reduce your CDE scope and conducting penetration tests.
Thumbnail of the Blog Illustration
Information Security
Published on
9/8/2022
Benefits of PCI DSS Compliance

In recent blogs, we have focused on how best to ensure you comply with the PCI Data Security Standard....

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
13/6/2022
PCI DSS v4 – Changes at a Glance

After several years wait, and to surprisingly little fanfare, the PCI SSC released the new version of the PCI Data Security Standard (DSS).

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
4/8/2022
PCI DSS Remediation and Implementation

PCI remediation is an essential activity for any organisation wishing to fully comply.....

Read more
It’s one thing having the required technical knowledge, it’s another thing for a consultant to apply that knowledge to the context of our organisation. To use a sporting analogy, we view cyber and information security as a marathon not a sprint. I am not a believer in doing everything all at once. Our approach has been risk based and incremental, remediating our biggest risks first before moving on. I believe this approach is far more sustainable and effective. And URM’s consultants fully understand this and are very pragmatic and tailored in their guidance and advice. They know we are not implementing ISO 27001 purely for the certificate, but more as a framework for continual improvement, and at a pace where new systems and processes can be fully understood and absorbed by our team and be business as usual.
The Owners and Distributors of Quality Brands
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.