[Autogenerated] welcome to this course on how to achieve
and maintain compliance with PC I.
DSS.
For many organizations, this can be a confusing, an expensive journey.
So my aim in this course is to simplify things and show you how you can make
secure compliance and not waste money in this first module.
We're going to set the scene by describing the typical compliance journey.
Remind ourselves of some of the key terms in PC,
idea says, and take a look at the P C.
I.
P qualification, which I'm going to try to persuade you to obtain.
Onda.
We gonna have a quick review of the standard in the core PC idea,
says concepts, but we need to make the most of this course.
But first I'd like to introduce my co author,
but Mr Jacob and sorry,
who's one of the most experienced PC I qualified Security assesses.
There is in the majority of the modules.
I'll be providing the theory based on my experience
working for the card brands on also helping lots of
organizations comply with PC ideas s.
And then Jacob will be giving the que esa the
qualified security assesses perspective.
So first of all.
What does an organization's typical compliance journey look like?
There are six key faces.
The first working at what compliance actually means is the
one that most organizations skip over.
But this is where a really thoughtful pause could be super valuable.
Its way.
You make sure you understand the compliance target that's been set for you,
because knowing away you're going before you start a journey is pretty sensible.
The second step is to make sure you understand how you process payments today,
on which networks, systems and applications that involves.
Thirdly, comes the part where most of the hard work is done.
There are a few bits to this.
You start off by deciding how much of your organization you
want to make compliant with PC I DSS,
and typically that's what people called scoping because implementing and
running the 300 PC idea says controls is expensive,
so the fewer people processes and systems that have to
meet the PC ideas s requirements,
the lower the implementation on on the ongoing costs.
Then, if you decided to alter the scope by some technical or architectural means,
you'll need to do this and you also probably will
undertake a high level gap assessment where you run
through the 300 also requirements in PC,
Idea says, and see how the controls you have match up.
And unless you're a bank,
it is unlikely that your high level gap assessment showed
no gaps to gate after some work to do, we implements policies,
processes and technologies to meet.
The PC idea says requirements.
Once this is done,
it be nice to think we're ready for your first PC ideas s assessment.
But that's often not the case to this phase is where you asking
assessors to do a more detailed gap assessment and for you to spend
some time remediating their findings.
The final step, once you completed remediation,
is to have your formal compliance assessment.
Then you're into business is usual, complies maintenance.
We're going to go through each of these steps in the
next six modules of this course.
My PC idea says the big picture course is listed as
a pre requisite for this course.
I really hope that you've taken that recently
because this is such a big subject, though with lots of its own special language.
I'm going to very quickly run through some of those core
terms you'll need to be familiar with.
Let's kick off with the key participants in the system starting with you,
because when PC Idea says refers to the organization
that's trying to comply with the standards,
it uses the word entity for your the entity.
Next, the card brands American Express, Discover,
JCB, MasterCard and Visa,
and sometimes you'll hear them refer to his cards games as well,
whatever you call them.
Together, they make up the PC I Security Standards Council,
the PC I SSC, or sometimes just the cancel,
and then in the payment ecosystem to financial institutions.
One.
The issues cards to consumers, unsurprisingly,
called an issuer or issuing bank,
and one that accepts payment transactions from merchants,
which,
depending on where you are in the world's maybe calls an
acquirer on acquiring bank or a merchant bank.
In this course, all call these people.
Acquirer's finally a service provider.
And that's what Pacey, I cause a supplier for 1/3 party,
someone you contract with to provide services to you.
Now a quick reminder of the four key faces in the payment transaction.
First authorization on sometimes capture where the merchant says the cardholder
data and sensitive authentication data via their acquirer to the issue to make
sure the card is valid on good for the transaction.
Secondly,
clearing where the merchant batches of the day's transactions that have been
authorized and asked their acquire it for the money here.
It's just generally the primary account number this included as
part of this process and then settlement,
where the acquires an issue is work out,
how much they all owe each other on which ends up with the
merchant receiving the funds they're owed,
the other two things that can cause cardholder dated to be
processed or where transactions are undone either because the
merchant provides a refund of the cardholder.
All because the carnal disputes the transaction and
requested charge back from there s zero.
Both of these typically caused the merchant to
process the primary account number.
Okay,
so that's the key organization types and the steps in the payment transaction.
Let's run through the alphabet soup of all the different PC I
people starting off with a qualified security assessor or que
essa They're the people authorized by the PC I SSC to carry out
formal PC ideas s assessments.
Que essays work for Q S.
A company's which you might also here called q s A sees
Internal Security Assesses or I s Eyes also train authorized
by the PC I SSC to conduct assessments.
They work for the entities that are required to comply with PC.
Idea says that as well as being trained to carry out assessments himself,
they can help an entity prepare for a Q s a assessment.
The final piece EI person we need to think about at the moment is a P C i p a
p C I professional PC I piece of a thorough training in PC Idea says on also
a good awareness of the other PC I standards.
They can't conduct assessments themselves,
but they can help entities prepare for an assessment and maintain
business is usual continuing compliance after an assessment.
If you're following this court or pappa plural site because
you're thinking of taking your P C I P exam,
the next clip is for you.
If not,
then just skip pastor into a quick review of the 12 PC ideas s requirements.
But before you do up,
if you are going to take an organizational compliance journey.
I'd seriously recommend you do consider the P C.
I.
P.
Quantification because as well as cementing your PC I knowledge,
you'll get access to PC I SSC re sources,
including Webinars newsletters and also the opportunity to attempt one.
The annual community may things.
It's also recognised qualification that you can put on your
resume A and you can take from job to job,
and you'll find it much easier to work with assessors
once you have the qualification.
Look, there's lots to learn about in PC,
Idea says as you make an organization compliant,
so you may as well have something to show for it.
Something individual, something just for you.
But you've got.
If I'm not convinced you there,
just skip over the notes clip and go to the PC ideas s requirements.
Otherwise, join me to find out how to become a PC.
I pay