{"id":1176,"date":"2022-07-02T21:45:11","date_gmt":"2022-07-02T21:45:11","guid":{"rendered":"https:\/\/securewayde.com\/pci-dss\/"},"modified":"2022-11-20T23:28:55","modified_gmt":"2022-11-20T23:28:55","slug":"pci-dss","status":"publish","type":"page","link":"https:\/\/securewayde.com\/en\/pci-dss\/","title":{"rendered":"PCI DSS"},"content":{"rendered":"

What is PCI DSS?<\/h1><\/div>

The Payment Card Industry Data Security Standard (PCI DSS) is a standard that includes technical and managerial requirements aimed at ensuring the security of credit and debit card transactions and protecting cardholders from misuse of their personal information. PCI DSS was introduced by five major credit card companies in 2004.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

What is PCI DSS?<\/h1><\/div>

The Payment Card Industry Data Security Standard (PCI DSS) is a standard that includes technical and managerial requirements aimed at ensuring the security of credit and debit card transactions and protecting cardholders from misuse of their personal information. PCI DSS was introduced by five major credit card companies in 2004.<\/p>\n<\/div><\/div><\/div><\/div><\/div>

<\/span> PCI DSS Controls<\/span><\/span> <\/span><\/h1><\/div>

Our methodology<\/p>\n<\/div><\/div><\/div><\/div><\/div>

01<\/h1><\/div>

PROJECT START MEETING<\/h1><\/div>

With a project kickoff meeting attended by senior management and relevant unit managers, the purpose, process, necessary resources and risks of the project are evaluated. In consultation with the relevant units, it is ensured that the scope that will be the basis for PCI DSS compliance and auditing is determined correctly.<\/p>\n<\/div><\/div><\/div>

02<\/h1><\/div>

DETERMINING THE SCOPE OF PCI DSS<\/h1><\/div>

While determining the scope, the business processes, locations, data centers, systems, employees, service providers, all processes and components related to the transmission, operation, storage, destruction of the credit\/debit card and any other aspects affecting the security of the card information are taken into consideration.<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>

01<\/h1><\/div>

PROJECT START MEETING<\/h1><\/div>

With a project kickoff meeting attended by senior management and relevant unit managers, the purpose, process, necessary resources and risks of the project are evaluated. In consultation with the relevant units, it is ensured that the scope that will be the basis for PCI DSS compliance and auditing is determined correctly.<\/p>\n<\/div><\/div><\/div>

02<\/h1><\/div>

DETERMINING THE SCOPE OF PCI DSS<\/h1><\/div>

While determining the scope, the business processes, locations, data centers, systems, employees, service providers, all processes and components related to the transmission, operation, storage, destruction of the credit\/debit card and any other aspects affecting the security of the card information are taken into consideration.<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>

03<\/h1><\/div>

PCI DSS DIFFERENCE (GAP) ANALYSIS<\/h1><\/div>

A difference analysis service is performed to determine the compliance of the existing structure with the current PCI DSS standard.
\nWith the analysis study, the elements that do not comply with the standard and the reasons for non-compliance are determined.<\/strong> As a result of the analysis service, a Difference Analysis Report is prepared. It is performed by QSA (Qualified Security Assessor) experts authorized by PCI SSC.<\/p>\n<\/div><\/div><\/div>

04<\/h1><\/div>

PCI DSS IMPROVEMENT CONSULTING SERVICE<\/h1><\/div>

Consultancy services are provided for Credit\/Debit card applications and payment infrastructure in accordance with PCI DSS. Secureway working together with the organization; a prioritized approach document is formed, work steps, responsible parties and deadlines are determined for the remediation of incompatibilities.
\nRequired documents are prepared for compliance.<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>

03<\/h1><\/div>

PCI DSS DIFFERENCE (GAP) ANALYSIS<\/h1><\/div>

A difference analysis service is performed to determine the compliance of the existing structure with the current PCI DSS standard.
\nWith the analysis study, the elements that do not comply with the standard and the reasons for non-compliance are determined.<\/strong> As a result of the analysis service, a Difference Analysis Report is prepared. It is performed by QSA (Qualified Security Assessor) experts authorized by PCI SSC.<\/p>\n<\/div><\/div><\/div>

04<\/h1><\/div>

PCI DSS IMPROVEMENT CONSULTING SERVICE<\/h1><\/div>

Consultancy services are provided for Credit\/Debit card applications and payment infrastructure in accordance with PCI DSS. Secureway working together with the organization; a prioritized approach document is formed, work steps, responsible parties and deadlines are determined for the remediation of incompatibilities.
\nRequired documents are prepared for compliance.<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>

05<\/h1><\/div>

PCI DSS SITE AUDIT
\n(ON-SITE AUDIT) SERVICE<\/p><\/h1><\/div>

After remediation of all the inconfirmities identified in the Difference Analysis Report, an On-Site Audit is performed with QSA (Qualified Security Assessor) experts authorized by PCI SSC.<\/p>\n

ROC as a result of audit service
\n(Report On Compliance) is prepared.<\/p>\n<\/div><\/div><\/div>

06<\/h1><\/div>

CERTIFICATE OF COMPLIANCE (AOC)
\nPREPARE AND SHARE<\/p><\/h1><\/div>

After the ROC document is prepared and shared by Secureway, the document is reviewed by the Organization. Upon confirmation of the organization, PCI DSS Compliance Certificate \u2013 Attestation of Compliance (AOC) document is prepared. The audit process ends with the signatures of the Auditor (QSA) and the Authority\u2019s officials.
\nIf the client is required to share audit documents with payment brands or banks, Secureway provides the necessary communication and information sharing in this regard.<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>

05<\/h1><\/div>

PCI DSS SITE AUDIT
\n(ON-SITE AUDIT) SERVICE<\/p><\/h1><\/div>

After remediation of all the inconfirmities identified in the Difference Analysis Report, an On-Site Audit is performed with QSA (Qualified Security Assessor) experts authorized by PCI SSC.<\/p>\n

ROC as a result of audit service
\n(Report On Compliance) is prepared.<\/p>\n<\/div><\/div><\/div>

06<\/h1><\/div>

CERTIFICATE OF COMPLIANCE (AOC)
\nPREPARE AND SHARE<\/p><\/h1><\/div>

After the ROC document is prepared and shared by Secureway, the document is reviewed by the Organization. Upon confirmation of the organization, PCI DSS Compliance Certificate \u2013 Attestation of Compliance (AOC) document is prepared. The audit process ends with the signatures of the Auditor (QSA) and the Authority\u2019s officials.
\nIf the client is required to share audit documents with payment brands or banks, Secureway provides the necessary communication and information sharing in this regard.<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>

PCI SSC and Standards<\/h1><\/div>

It is a standard developed by the PCI council to ensure the security of payment cards. Established by VISA, Mastercard, American Express, Discovery and JCB, the council establishes security standards for payment cards and leads the payment cards industry in their announcement, training and audits.<\/p>\n<\/div>

Standards published by the PCI council<\/h1><\/div>
  • <\/i><\/span>
    PCI DSS – Payment Card Industry Data Security Standard<\/div><\/li>
  • <\/i><\/span>
    PA-DSS – Payment Application Data Security Standard<\/div><\/li>
  • <\/i><\/span>
    P2PE – Point to Point Encryption Standard<\/div><\/li>
  • <\/i><\/span>
    PTS – Pin Transaction Security<\/div><\/li>
  • <\/i><\/span>
    PCI 3DS – PCI 3DSecure Core Security Standard<\/div><\/li>
  • <\/i><\/span>
    PCI SSS – Secure Software Standard<\/div><\/li>
  • <\/i><\/span>
    Card Production<\/div><\/li><\/ul><\/div><\/div>
    \"PCI<\/span><\/div><\/div><\/div><\/div><\/div>

    PCI SSC and Standards<\/h1><\/div>

    It is a standard developed by the PCI council to ensure the security of payment cards. Established by VISA, Mastercard, American Express, Discovery and JCB, the council establishes security standards for payment cards and leads the payment cards industry in their announcement, training and audits.<\/p>\n<\/div>

    Standards published by the PCI council<\/h1><\/div>
    • <\/i><\/span>
      PCI DSS – Payment Card Industry Data Security Standard<\/span><\/div><\/li>
    • <\/i><\/span>
      PA-DSS – Payment Application Data Security Standard<\/span><\/div><\/li>
    • <\/i><\/span>
      P2PE – Point to Point Encryption Standard<\/span><\/div><\/li>
    • <\/i><\/span>
      PTS – Pin Transaction Security<\/span><\/div><\/li>
    • <\/i><\/span>
      PCI 3DS – PCI 3DSecure Core Security Standard<\/span><\/div><\/li>
    • <\/i><\/span>
      PCI SSS – Secure Software Standard<\/span><\/div><\/li>
    • <\/i><\/span>
      Card Production<\/span><\/div><\/li><\/ul><\/div><\/div>
      \"PCI<\/span><\/div><\/div><\/div><\/div><\/div>

      PCI DSS Merchant Levels<\/h1><\/div>

      PCI DSS Merchant
      \nLevels<\/h1><\/div>
      <\/div>
      \n \n \n \n \n \n <\/colgroup>\n \n\n \n\n \n \n \n \n
      CATEGORY<\/th>CRITERIA<\/th>REQUIREMENTS<\/th><\/tr>\n<\/thead>\n
      Level 1<\/td>\u2022 Businesses that have been exposed to any hack or attack and whose customer information has been compromised (Account Data Compromise - ADC) - Businesses with more than 6 million total Mastercard and Maestro transactions per year

      \u2022 Businesses that meet the Level 1 criteria of VISA

      \u2022 Businesses that MasterCard voluntarily considers as Level-1 in order to reduce risk<\/td>      		\u2022 Annual on-site audit<\/td> <\/tr>\n
      Level 2<\/td>\u2022 Businesses with more than 1 million total Mastercard and Maestro transactions less than or equal to 6 million annually

      \u2022 Businesses that meet the Level 2 criteria of VISA<\/td>      		\u2022 Annual on-site audit or Self Assessment<\/td> <\/tr>\n
      Level 3<\/td>\u2022 Businesses with more than 20,000 total Mastercard and Maestro e-commerce transactions per year, but less than or equal to 1 million total annual Mastercard and Maestro transactions

      \u2022 Businesses that meet the Level 3 criteria of VISA<\/td>      		\u2022 Annual Self Assessment

      \u2022 On-site audit according to the preference of the workplace (On-site Audit)<\/td> <\/tr>\n
      Level 4<\/td>\u2022 All other businesses<\/td>\u2022 Annual Self Assessment

      \u2022 Annual Self Assessment<\/td> <\/tr>\n <\/tbody>\n <\/table>\n \n \n \n<\/div>\n<\/div><\/div><\/div><\/div>

      PCI DSS Service Provider Levels<\/h1><\/div>

      PCI DSS Service Provider
      \nLevels<\/h1><\/div>
      <\/div>
      \n \n \n \n \n \n <\/colgroup>\n \n\n \n\n \n \n
      CATEGORY<\/th>CRITERIA<\/th>REQUIREMENTS<\/th><\/tr>\n<\/thead>\n
      Level 1<\/td>\u2022 All third party processors \u2013 All Third Party Processors (TPPs)

      \u2022 All third party processors \u2013 All Third Party Processors (TPPs)

      \u2022 All digital activity providers \u2013 All Digital Activity Service Providers (DASPs)

      \u2022 All Token Service Providers \u2013 All Token Service Providers (TSPs)

      \u2022 All 3D Secure Service Providers \u2013 All 3D Secure Service Providers (3-DSSPs)

      \u2022 All AML\/Sanctions Service Providers \u2013 All AML\/Sanctions Service Providers

      \u2022 All Data Storage Entities (DSEs) and Payment Facilitators (PFs) with more than 300,000 total combined Mastercard and Maestro transactions annually<\/td>      		\u2022 Annual on-site audit. Must be performed by a QSA approved by PCI SSC.<\/td> <\/tr>\n
      Level 2<\/td>\u2022 All Data Storage Firms and Payment Service Providers with 300,000 or less total Mastercard and Maestro transactions per year All DSEs1 and PFs with 300,000 or less total combined Mastercard and Maestro transactions annually

      \u2022 All Terminal Providers \u2013 All Terminal Services (TSs)<\/td>      		\u2022 Annual Self-Assessment
      (Self Assessment)<\/td> <\/tr>\n <\/tbody>\n <\/table>\n \n \n \n<\/div>\n<\/div><\/div><\/div><\/div>

      Contact us<\/h1><\/div>

      Please let us know
      how we can assist<\/h1><\/div>

      Secureway\u2019s business philosophy is to provide the highest quality innovative solutions, total customer satisfaction, timely delivery of solutions and the best price performance available in the industry.<\/p>\n

      Our mission is to help you improve your security performance, reduce risks, make you more productive, less stressed and a little more confident.<\/p>\n<\/div><\/div><\/div>

      Contact Form<\/h1><\/div>
      \n Form EN<\/legend>