PCI Audit: What is it?

PCI audits are meant to check the security of a firm’s credit card processing system from start to end. During a PCI audit, your organization’s Internal Security Assessor or an independent Qualified Security Assessor (QSA) will determine how effective your information security controls are.

For your organization to pass the test, the network payment network that you have put in place needs to fulfill up to 281 criteria that are captured in the PCI DSS standard. All merchants who process credit card payments, as well as their vendors, must comply with this standard.

To prove PCI compliance, your organization needs to either fill out a PCI DSS questionnaire or undertake and on-site audit that is overseen by an Internal Security Assessor or a QSA. The PCI DSS questionnaire is self-administered. You may choose to involve an internal audit when filling out this questionnaire.

If your organization processes more credit card transactions, there’s a greater need for you to undertake an annual audit besides maintaining a Record of Compliance (ROC). This way, you will satisfy one of the most crucial requirements of the PCI DSS security framework.

Why PCI DSS is Important

The PCI Security Standards Council (PCI SSC) is an organization that represents financial institutions, processor companies, software developers, point-of-sale vendors, and merchants. It established PCI DSS to prevent breaches relating to cardholder and credit card data.

The PCI DSS framework can be traced to 1999 when Visa pioneered its Cardholder Information Security Program. This was in response to the rampant increase in instances of credit card fraud on the Internet, which was also blossoming at the time. In 2004, the leading credit card brands partnered to launch the groundbreaking version of the framework, PCI DSS 1.0.

Today, all internet service providers and merchants can only accept and process credit card payments after demonstrating a continual and ongoing commitment towards the protection of cardholder and credit card data from unauthorized access.

What’s Your Level of Compliance?

It is in recognition of the fact that not all merchants and service providers are equal that the PSI SSC established two compliance levels for ISPs and four for merchants. The higher the compliance level, the more strict the PCI DSS requirements.

To ensure compliance with PCI DSS, a Level 1 merchant or ISP must attain the ROC. This entails undertaking an audit. On the other hand, those at Levels 2, 3, and 4 can conduct a self-assessment by filling out a questionnaire provided by the security standards council.

The level that your organization belongs to is determined by:

• The type of credit cards that you accept
• The number of transactions that you process

Typically, a Level 1 merchant processes between 1 to 6 million transactions annually. Similarly, Level 1 service providers handle up to 300,000 credit card transactions every year.

What Does a PCI DSS Audit Entail?

For your organization to attain its ROC, an on-site audit needs to be carried out. Since 12 objectives and 281 directives need to be complied with, the initial audit can take up to two years. Self-assessing takes less time since it can be completed within one year.

A PCI DSS audit or assessment entails testing all the controls that pertain to your organization’s Cardholder Data Environment (CDE). This includes the point-of-sale system, your vendors’ data security, access, network segmentation, applications that process payment information, location, and manner of data storage, data encryption, and the security of routers that transmit data.

All this might sound confusing, but PCI DSS is remarkably prescriptive. It points out what you should do to abide by each directive. Each requirement applies to a specific organization. As a result, you may even have less than 281 requirements to comply with.

When repairing for self-assessment or An audit, you can take the following steps to expedite the process and reduce the costs involved.

• Define your scope. This involves perusing the framework to determine which directives apply to you.
• Reduce your scope. By simply imposing firewalls around your CDE, you will lower your susceptibility to cybercrime besides reducing the systems that an auditor will have to evaluate.
• Determine how you meet every applicable PCI DSS requirement. Your organization’s risk assessment guidelines can help you with this. Where you don’t comply, you should implement the necessary controls.
• Examine your controls before each annual audit or assessment. Since PCI DSS compliance is a continual process, constant vigilance is necessary.
• Gather the required evidence. In this regard, you should keep in mind the fact that documentation is a crucial component of any audit. Therefore, ensure that your documentation is in order before embarking on an audit or self-assessment.

Credit card data breaches and fraud cases are on the rise even as ISPs and merchants implement stricter controls. Following the steps, as mentioned earlier, can go a long way in enabling you to ironclad your organization’s credit card data security.