In the previous module,
we worked out which of the PCI standards Wired Brain
Coffee would have to comply with.
So let's see who they'd be able to get to help them.
As an organization that stores or processes or transmits
cardholder data in its coffee shops,
Wired Brain Coffee will be asked by its acquirer to
demonstrate compliance with PCI DSS.
It would need to give its acquirer a report on compliance produced either by a
Qualified Security Assessor or an Internal Security Assessor,
and the report on compliance, which is also known as a RoC,
would state whether Wired Brain Coffee was compliant with PCI DSS.
Similarly,
Wired Brain Coffee would need to demonstrate compliance with
PCI DSS for its e‑commerce activities and,
again, would require a QSA or an ISA.
It could be that Wired Brain Coffee is using validated payment
software in its stores or in its payment system.
So you might think a Secure Software Assessor's what's required.
But remember that the PCI SSC lists validated payment software,
so the application will have already been assessed by a Secure
Software Assessor working for the application vendor.
Wired Brain Coffee may have used a QIR, a Qualified Integration Reseller,
to install the application correctly,
and this we validated by the QSA or ISA as part of their PCI DSS assessment.
In the coffee shops,
Wired Brain Coffee has installed chip and PIN card reading devices,
and Wired Brain's acquiring bank insists that these
would have been validated to PCI, PTS, POI.
So which assessor do we need for that?
Actually, this is a bit of a trick question, but it's one that people often ask.
The terminal or the card reading device will have
originally been assessed by a PTS laboratory,
and so it's already listed on the PCI SSC website.
But the use of the PTS‑listed device is one of those things that's
required by card schemes in their acquiring contracts.
It's not a requirement of PCI DSS.
And so it's not something that QSA needs to look at.
I've mentioned it here because there's often a lot of confusion about this,
and sometimes QSAs try to enforce this.
This is the job of the acquirer to enforce this on their merchants.
So, typically,
the acquirer checks this when a merchant first wants to
connect their terminal to the acquirer.
Finally, moving away from Wired Brain Coffee,
we also discovered how PINs move from merchants to issuers,
so the issue could validate that the PIN is correct.
Card schemes will require acquirers to validate their
compliance with the PIN standards,
and this compliance will be assessed by a Qualified PIN Assessor,
or QPA.
And, finally, Card Production.
A Card Production Security Assessor will validate that
organizations comply with the physical and logical security
requirements of the PCI Card Production standards.
Now let's round up quickly what we've discovered.
Most importantly,
remember that the PCI SSC writes and maintains the security standards,
but it is the card brands or card schemes that say who
has to comply with each standard.
Whenever I am asked to help an organization with PCI DSS compliance,
my first question is, Who's asking you to be compliant and why?
Remember, it's not the law.
It's usually a contractual requirement between a merchant
and a card scheme or a merchant and an acquirer or a
service provider and the merchant.
For each PCI SSC standard, there's an assessment process.
Where the standard relates to a product or solution,
either an assessor or a qualified laboratory that has been
specifically trained in the standard,
they can undertake an assessment of the product or solution.
Products or solutions that pass the assessment can
be listed on the PCI SSC website.
So prospective purchases of the product or the solution can determine
which ones have been validated to the respective standard.
Standards that apply to products or solutions include the Secure
Software Standard for payment applications,
PTS POI and PTS HSM for payment hardware,
and P2PE, SPoC, and CPoC for payment solutions.
Some card brands or schemes say that merchants that accept their
cards must use PCI SSC‑listed products or solutions.
Where the standard applies to how an organization secures payment card data,
again, the PCI SSC trains and qualifies assessors for each standard.
The organization who wants to be assessed against the standard
engages the relevant Qualified Security Assessor,
who, at the end of the assessment, gives their report to the organization.
The organization can then pass this report on to anyone that
has required it to comply with the standard.
Standards that apply to how organizations secure payment card
data include the Data Security Standard,
PCI DSS, PCI PIN, the 3DS core standards,
Card Production, and the Token Service Provider security standard.
And card brands or card schemes often specify that organizations
must be assessed annually against these standards.
Finally, there's one other PCI qualification that we haven't looked at yet,
the PCI Professional, or PCIP.
This qualification is open to anyone working in the payment industry.
It's not tied to a role or a company,
and it isn't about an assessment or related to a standard.
It shows that you've got a good general awareness for
payments for the PCI standards, and PCI DSS in particular,
and good general security concepts.
And if this could be you,
the next module looks at the PCI Professional Qualification in greater detail.