Next, let's take a more in depth look at the PSI DSS compliance documents,
RoCs and SAQs.
Both of them are ways of documenting that PSI DSS requirements are in place.
They do this by recording that the testing procedures
defined in the standard have been undertaken.
Now,
there are three PCI qualifications awarded by the PCI
Security Standards Council that are intended to help
organizations in their PSI DSS assessments.
Two of these roles, these qualifications,
can formally complete the Report on Compliance.
The Qualified Security Assessor, or QSA,
works for an external company and they've been trained and
certified to assess and organization's compliance with PSI DSS
and produce a Report on Compliance.
Internal Security Assessors, or ISAs,
have the same training and exam as a QSA but they work
within the organization being assessed.
They might be part of the organization's internal audit team.
Some card brands allow ISAs to complete Reports on Compliance.
A PCI Professional, or PCIP,
has been certified by the PCI SSC to have a good general knowledge of PSI DSS.
So they can certainly help with compliance projects,
but they're not authorized to complete Reports on Compliance.
A Self Assessment Questionnaire, an SAQ,
could be completed by a QSA, an ISA, a PCIP,
the Company CEO, yup even Terry the Janitor or Sally the DBA.
There are no rules about who can complete the Self Assessment Questionnaire.
However,
the final document needs to be countersigned by an officer of the organization
and they're attesting to the fact that all of the PSI DSS requirements have
been tested and have been found to be in place.
Now let's have a look at worth the RoC and the SAQ
actually physically look like.
So starting with the RoC,
you can see that for each requirement the assessor can
mark the requirement as in place, in place with compensating controls,
not applicable, not tested, or not in place.
Then for each requirement, the RoC lists the testing procedures,
the instructions to the assessor about what they should include in the report,
and there's space for the assessor to actually
write and document their findings.
So they would say, well I interviewed this person,
I saw this document, that type of thing,
or I looked at this system and I validated that it was
configured in the way that it was supposed to.
So a completed Report on Compliance is actually a really long document.
Now the SAQ.
You can see this is similar, but it's less prescriptive.
So for each of the requirements,
the expected testing is just listed as short bullet points.
So here's the requirement,
here's what you're expected to do to test that the requirement is in place,
and now the person completing the Self Assessment Questionnaire merely
has to tick whether the requirement was in place,
in place with compensating controls, not in place,
not applicable, or not tested.
They don't have to write down which documents they looked at and
which people they spoke to because they're attesting themselves
that the requirements are in place.
Now remember,
it's up to contractual obligations and the card brand rules
whether an organization has to provide Report on Compliance or
a Self Assessment Questionnaire.
This is typically based on two criteria.
Firstly,
the number of transactions the merchant accepts each year and often
the cutoff point is six million transactions.
Secondly,
the way in which the merchant accepts payment cards because there isn't just
one SAQ but there are eight Self Assessment Questionnaires.
Each Self Assessment Questionnaire contains the number of requirements that are
appropriate to the way that the merchant accepts payments.
We could talk for hours about how an organization chooses which SAQ to use,
but for the big picture, SAQ A is used when all payment processing is outsourced.
SAQ A-EP is used when eCommerce acceptance is partially outsourced.
SAQs B, B-IP,
and P2PE are used for merchant that accept payments using a
dedicated payment device such as a chip and pin machine and
typically in a face-to-face environment or a store.
SAQ Ce is also used by face-to-face retailers who use payment
applications on their point of sale systems.
SAQ Ce-VT is used by merchant that accept payments over the
telephone and enter the card data into an acquirer or a
payment service provider's portal.
SAQ D is used by every other type of merchant.
This one contains all the requirements that are in the full standard.
There's a really helpful document on the PCI SSC website that describes when
to use each SAQ and you can download it from this URL.