[Autogenerated] There's just one type of reporting compliance,
and it contains all 300 or so PC ideas.
S requirements in a later module will actually look at how the Q s
a uses the rock to document their assessment.
There are eight self assessment questionnaires,
and they're designed to cater for the most common ways that
smaller merchants accept payment card data.
Each self assessment questionnaire describes the environment is
designed for and also the eligibility criteria that merchant must
fulfil to be able to complete the S A.
Que Remember,
what we doing here is to try to understand the different ways
we may be asked to validate our compliance.
So I'm gonna quickly run through the key attributes of each of
the essay cues on the important thing within.
I say Q is they were designed for smaller merchants and also
that their sort of tied to the different acceptance channels we
talked about in the previous clip.
So let's start with S a que a now s a que a can only be used in card,
not present acceptance channels to US e commerce on Moto,
and not face to face a key feature of S a Que a is that all payment
processing is outsourced to a PC I DSS compliant service provider,
so the merchant does not store, process or transmit any cardholder data.
And even though the merchant doesn't have anything to
do with cardinal the data directly,
there are some technical requirements that apply to a merchant's website because
the website might start a payment transaction and then either redirect the
consumer to 1/3 party payment page or in bed about third party payment page in
that I frame on the Motions own website on.
Also, as you expect,
there is some non technical requirements that look at the
merchant's relationship with the third parties that process
payment card data on the merchants behalf.
S H A P is designed for just e commerce merchants who partially
outsource the processing of their cardholder data but whose website is
initially responsible for the security of the payment transaction and
how the cardholder data is collected on.
So if that website was compromised by a criminal,
the criminal will be able to skin the cardholder data on this is an attack.
You probably heard of its attack that's commonly referred to as
an E commerce skimming or a major kart attack.
And so, as you'd expect, their requirements and s a que au pe,
they're concerned with the security of a Web server.
There's quite a lot of requirements.
Nesic, you ap.
And there are also those requirements relating to the
relationship with the third parties that process payment
card data on behalf of the merchants.
Now, where s a Q and A.
P would designed for card, not present acceptance channels?
The next three essay accuser, mostly designed for face to face merchants,
are set to Q B, B, I,
p and S a Q p two p e starting off with S a Q B that's
intended to be used by merchants using payment terminals
to accept a card transaction.
And then the payment terminal dials out of Retaliate phone line.
Have the transaction authorized on when I talk about dialing out that
could also be dining out over a mobile communications?
No, it's a street.
Your 40.
They're merchant shall have no other processing of cardholder data,
although they might receive, you know,
printed documents containing carnal the data because you might
use this in a small mail order environment.
All those probably designed for face to face Rito on perhaps 10 years ago.
The separately,
common away for small face to face returns to accept payment transactions.
But, you know, with widespread availability of the Internet,
dial up payment terminals.
You don't see them that often these days,
which is why we have s a Q B i p,
which designed for merchants taking face to face transactions again,
whether where the card is swiped, dipped or taps.
But this time the payment terminal connects to the acquirer
or the payment process of using the Internet and actually
rather just any Pirmin terminal,
the payment terminal or as the S a que calls it the point of interaction or P O.
I must be listed on the PC I SEC website,
and that's because it uses a network connection.
And so the payment terminal needs to have been tested to make sure that
that network connection is secure so it can't be any random payment
terminal has to be a listed payment terminal.
These network connected payment terminals have to be on their own,
not connected to any of the systems off the merchant e
ver now just a sui that's a Q B,
but can be no receipt by the Merchant or or
Elektronik stories of cardholder data.
The final essay que designed for face to face merchants using payment
terminals s a Q p two p e e requires the merchants to be using a
validated point to point encryption solution,
as listed on the PC SSC website.
Now Peter P.
E.
Solutions encrypt the cardholder data within a secure
part of the point of interaction.
And then it's just is really strongly encrypted cardholder data,
which is present in the merchants environment.
So it massively takes away the PC ideas s requirements.
Typically,
these pizza piece officials are going to be used in
supposed to face acceptance channels,
although again you could be using payment terminals in Moto as well.
But that's pretty rare.
So again, no electronics stores,
right or receipt or processing cardholder data beyond what's done in the peat p.
A solution on ___ solutions.
They're really good for taking a lot of the PC idea,
says Headache away from return Environments s a que seas of really
interesting essay que no one that's really decreasing in uses.
More and more merchants move to using listed payment terminals to reduce
the footprint of cardholder data in their environments.
S A QC is designed typically for payment systems,
which typically of bean point of sale systems or electronic cash registers,
which accept the cardholder data directly on we stand.
Send it off to the acquirer or to the payment process on.
Although the point of sale system processes can hold the data and transmits it,
it can't story.
There's no storage of carnal today.
It's permitted.
If a merchant wants to use s sake.
You see, that's partly eligibility criteria.
This essay queues again,
really designed for face to face environments again could
be used by mental the telephone order, but it can't be used by e commerce.
Acceptance channels is not designed for that.
Next as a cue CVT now that's designed for merchants who use
what what we used to be called on maybe is somewhere so
it's called a virtual terminal.
So the idea is the merchants typically use their Web browser to
connect to their acquire or their payment processor,
and then they type in the customer's car,
told the date of a card number, the cvv,
the expiry date, etcetera into this website to process a transaction.
It's really typically used in mail order or small
telephone older accepted channels.
And again, just is with a stake.
You see no storage of cardholder data, no electrolyte received cardholder data.
So the scenario that's envisaged is there's an agent on the telephone.
They were taking the cardholder data from cover Consumer,
and they're typing it straight into this virtual terminal.
Or that opening a mail order orders and they're reading out the they
can see the card data they're typing into a terminal.
The final Shue Shue D is the Wonder Merchant has to use if it does not meet
the eligibility criteria of any of the other seven s A cues.
We've just looked out just like your reporting compliance.
It contains all 300 PC ideas s requirements in this table.
I've also summarized the number of requirements that
contained within each essay Q.
So you can get some idea of the complexity of them on.
As you can see, if the merchants eligible to complete what his essay cues,
it can Masset and reduce the amount of work required to
demonstrate its compliance with PC.
Idea says so just quickly before we move on from here,
because this is moderately important.
Let's just go over the environments that each s accuse designed for S a
que a is used when all payment processing is outsourced.
Essick u A e p is used.
When e commerce acceptance is partially outsourced, I say cues be V I.
P and P two p e are used for merchants that accept
payments using a payment terminal,
which will typically be in a face to face environment as a Q C
is also used by face to face retailers using payment
applications on their point of sale systems.
S A Q C B T is used by merchants that accept payments over
telephone and mail and then to the card dated directly
into an acquirer or a payment.
Service Providers Virtual Terminal, VT.
Virtual Terminal aan s sake.
You d is used by every other type of merchant that has to complete an essay
cube and contains all the requirements in the full standards.
That's all 300 requirements Now.
There are a couple of strange things about using essay cues that could
make demonstrating complies just a little bit easier.
So call these tricks of the trade.
But there what you can do, but not everyone knows about them.
So the first of these is that you can combine two
different excuse when reporting compliance.
You can only do this if the to accept.
As channels are completely separate,
there's no collectivity or data show between the two.
So imagine if you had a bunch of retail stores that all used network
connection payment terminals to process card payments.
And then separately, you have a totally different e commerce website,
which outsources payment processing to a payment service
provider or to the acquiring bank.
So in this case, the merchant will be able to use to s sake use.
They'll be able to use S A Q B i p for their retail stores.
That s a que a for the e commerce website.
The seconds really clever thing you could do with an essay.
Q is to use as the basis of a report compliance.
Now remember that all the essay cues except S H u D.
Required a merchant to attest to a subset of the requirement in the PC,
idea says,
but only if they meet the eligibility criteria to
completely s a que and so for Merchant,
who's required to report its compliance for an on site assessment and rock.
If if that merchant meets the eligibility criteria for on the S A cues,
it can ask its assessor and its acquirer whether it could just
reporting the compliance status of the controls.
The requirements contained in the appropriate s a que
marking all of the others is no applicable.
This is something that you need to discuss with your assessor and is detailed
in F A Q 1331 which you can find on the PC I SSC website.