In all the talk about contracts,
we didn't mention the role of the PCI SSC, and that's because they
don't have one, and this is the crucial point.
The PCI SSC is a standards body.
It just developed and maintains the standards. The card
schemes, via their acquirers, tell organizations, and I guess
if you're interested in this course,
the organization where you work, the card schemes via their
acquirers tell organizations to comply with one of the
standards that the PCI SSC writes.
So, a card scheme makes a merchant comply with PCI DSS via
the scheme's contract with the acquirers.
The PCI SSC writes and maintains PCI DSS.
A card scheme will make sure that service providers to
merchants also comply with PCI DSS via the schemes contract
with acquirers, and their contracts with merchants. And the PCI
SSC writes and maintains PCI DSS.
A card scheme will make an acquirer comply with PCI PIN, and the PCI
SSC writes and maintains the PCI PIN standard.
The card scheme may make merchants only use PCI PTS POI validated devices,
which it would enforce through its contract with acquirers,
saying to the acquiree your merchants must use these devices, and the
PCI SSC writes and maintains the PCI PTS POI standard.
And this is really important. Because let's say you get to a
place where, for some reason, it's impossible for you to comply
with one of the requirements of PCI DSS.
It isn't the PCI SSC who you need to talk to.
It is the organization that is contractually asking you to comply, and
if you're a merchant, that's usually your acquirer.
So, if the schemes make organizations comply with the
standards that the PCI SSC writes,
what else does the PCI SSC do, as well as writing standards? There
are two other main activities that have some effect on how your
organization will process payments.
The first is they train and certify assessors who are able to validate
that an organization is compliant with the standard,
such as PCI DSS. Or assessors who can validate that products or software or
solutions are also compliant with the relevant standards,
such as the software security standard. Because some of the PCI
standards are for hardware, the PCI SCC also accredits specialist
laboratories that have the facilities to be able to test hardware
devices, such as the card reading terminals,
the POIs, and hardware security modules,
the HSMs, that they meet the PCI‑specific security standard. And as well
as accrediting assessors and laboratories, the PCI SSC also run programs
that allow companies that have had their software or hardware or solutions
assessed to the relevant PC standard to be listed on the PCI SSC website.
This means that the PCI SSC would have reviewed the report produced by the
assessor or the lab, and make sure that the assessment was done properly.
The PCI SSC lists payment applications, and P2PE, SPoC, and CPoC solutions.
It also lists hardware devices that have been assessed to PCI standards,
so card reading and PIN accepting terminals to the PCI PTS POI
standard, and Hardware Security Modules. Just in case there was any
doubt, and I can't emphasize this enough, the PCI SSC does not make
anyone comply with any of the PCI standards.
If we need to comply with any of the standards,
there's a fair chance that we're going to need one of the
professionals accredited by the PCI SSC to help. You see, for every
standard we have learned about, there is typically an assessor that
has been qualified to assess against the standard, or in some cases, a
laboratory. And as you can see,
there are quite a few types to choose from, but unlike many accreditation or
certification programs you may have come across before, the PCI SSC manages
things a bit differently, in that both the assessor and the company an
assessor works for needs to be authorized.
So a company will say to the PCI SSC,
we'd like to be authorized to assess things.
The PCI SSC will ask the company to sign a contract,
take out some insurance, and pay the PCI SSC an annual fee to be a member
of the program. And then once the company is approved,
it can then go out and hire individual assessors who have
to sign the PCI SSC code of conduct,
have their company pay a fee, and then take some training and pass the relevant
assessing exam for the standard that they want to assess.
So now the company is authorized, and so are their assessors.
As well as assessors and assessor companies,
there are two other types of companies that the PCI SSC
authorizes for particular functions.
Some of the standards that apply to products are assessed by
accredited laboratories, who can evaluate against the more
technical and hardware‑based standards.
And then there are three programs,
the companies that offer specific services to the payment ecosystem where
both the personnel and the company have to be authorized.
PCI Forensic Investigators, or PFIs, are used after a data
breach to find out what happened, and also to make sure
that the breach has been sealed.
Approved Scanning Vendors, or ASVs, are authorized to conduct external
vulnerability scans according to the PCI program for these.
Because having an external vulnerability scan is actually one of the key
requirements of PCI DSS, and also a separate requirement of some card
schemes. And Qualified Integrators and Resellers,
or QIRs, are trained in the installation of point‑of‑sale
systems that handle cardholder data.