In this next module,
we're going to look at what it means to comply with the standard.
But we can't talk about compliance without first
talking about another strange PCI term, which is card brand or card scheme.
The terms are used interchangeably.
They mean the same thing,
which is one the five card companies that founded the
PCI Security Standards Council.
They are American Express, Discover, JCB, MasterCard, and Visa.
Because, as we discovered in the introduction,
generally, compliance with PCI DSS is not a legal requirement.
But organizations comply with it because it's a contractual requirement.
And that contractual requirement generally starts with the card brands.
The types of organization that will have a contractual obligation
to be compliant are organizations that store,
process, or transmit cardholder data.
Typically,
there are three types of organizations that will fall in this category.
Financial institutions, who both issue and acquire payment cards,
merchants that accept payment cards, and service providers who provide,
often IT, services to financial institutions and to merchants.
Something that's quite important to note is that the only thing
that can be PCI DSS compliant is an organization that's a single
legal entity including the people, the processes,
the building, the software, the network,
the hardware and everything.
This is really important because people will try to sell you things claiming
that the thing that they're selling is PSI DSS compliant.
So for the avoidance of doubt,
there is no such thing as PSI DSS compliant software or PSI DSS
compliant hardware or even PSI DSS compliant people.
The only thing that can be PSI DSS compliant is an entire organization.
Now, when we're considering PSI DSS compliance,
there are three things we need to address.
Who is asking us to comply with PSI DSS,
why are they asking us to comply with the standard,
and finally how do they want us to validate that we
are compliant with the standard.
Let's look at that last question first because there are two ways an
organization can validate that it is compliant with PSI DSS.
In can undergo a formal assessment which will produce a
document called a Report on Compliance, alternatively,
the organization can complete a Self Assessment
Questionnaire which is as the name suggests their own
assessment of their own compliant status.
Next,
we're going to explore some typical examples of
organizations that need to comply with PSI DSS,
see who might be asking them to comply,
and find out whether they would need a Report on
Compliance or a Self Assessment Questionnaire.
Firstly,
all merchants will be asked to comply with PSI DSS by
their acquiring or merchant bank.
This will be part of their contract with the bank.
Depending on the number of transactions a merchant
accepts on payment cards each year,
the merchant will either need the Report on Compliance or will have
to complete the Self Assessment Questionnaire.
This is dependent on the individual card scheme
rules that the acquirers enforce.
Generally, merchants that process more than six million transactions a year,
will need a Report on Compliance.
Merchants that process less than six million transactions a year,
or a single card brand per year, will need a Self Assessment Questionnaire.
This is really annoying,
but the five card brands don't actually have the same rules.
So it could be, for example,
that Visa asks a merchant for a Self Assessment Questionnaire while
MasterCard would ask for a Report on Compliance.
The card brands American Express and Discover have direct contracts with their
merchants that require the merchants to comply with PSI DSS.
And again,
whether the merchants will have to complete a RoC or SAQ is dependent on the
number of transactions that merchant accepts each year.
There's another occasion a merchant may be asked to validate its
compliance with PSI DSS and that's after a data breach.
Whenever a merchant suffers a data breach,
the card scheme will insist that the merchant validate its
compliance after the breach with a Report on Compliance.
Now service providers.
Typically,
the customer of the service provider will have a
contractual obligation to comply with PSI DSS.
They will therefore ask their service provider to comply with PSI DSS.
How the merchant asks the service provider to validate its
compliance is a matter for contract negotiation.
Although typically,
a merchant will ask a service provider for an externally
produced Report on Compliance rather than an SAQ.
Some of the card brands run schemes that list validated
service providers on the card brand's websites.
This provides and indication to merchants that use the website that the
service provider has validated its compliance with PSI DSS.
If you're a service provider and you want to appear on such a list,
you'll have to provide a Report on Compliance directly to the card brand.
Service providers to financial institutions that issue or acquire
payment cards will have a contractual requirement with the financial
institution to comply with PSI DSS and to validate their compliance via
a Report on Compliance not on SAQ.