What is PCI DSS?
The Payment Card Industry (PCI) Data Security Standard (DSS) denotes a set of technical and organizational requirements developed to assure all companies that process, hold or transmit cardholder information stay compliant and maintain a secure payment environment. In the Payment Card Industry (PCI), every Merchant and Service Provider will require to protect their customer’s cardholder data.
ValueMentor’s PCI Certification programs help customers achieve PCI DSS Compliance and payment security.
PCI DSS QSA companies are authorized to validate the compliance of merchants & service providers. Merchants have a contractual obligation to comply with PCI DSS requirements. Enable multiple layers of security in the Payment Card Industry (PCI) through our simplified PCI Certification & Compliance Process.
PCI DSS Certification Program
Would you like to speak to a PCI Consultant?
Define PCI Certification Scope
The initial phase of a PCI DSS QSA engagement is to define the scope of PCI certification/attestation. This is an integral part of PCI compliance services.
PCI Project Initiation
- Project Initiation
- Understand the organization
- Identify critical business services
- Identify information infrastructure
CDE Systems & Networks for PCI DSS Compliance
- Identification of the PCI Inscope Systems
- Determining the Networks that comes under CDE
Cardholder Data Flow
- Determine the systems which store, process or transmit cardholder data
- Identify and validate the cardholder dataflow
Network segmentation review
- Review the network segmentation controls used to segment the PCI cardholder network from the corporate network.
PCI Gap Analysis / Initial PCI Audit
The second phase of the PCI DSS Certification project is to identify the gaps in control implementation. A PCI DSS QSA reviews the control implementation using the PCI ROC testing procedures.
PCI Awareness for Stakeholders
PCI awareness and the information on the audit process are well-communicated to the project stakeholders prior to the PCI Gap Assessment.
Review of PCI Documentation
PCI policies and procedures get reviewed to identify potential gaps associated with PCI documentation requirements.
Review of CDE Systems for PCI DSS Compliance
Review the PCI Controls implementation on the PCI CDE systems, including servers, desktops, applications & network devices
PCI Gap Assessment Reports
- PCI DSS Gap Assessment Report
- PCI Remediation tracker
- General PCI Advisory on PCI gap closures
PCI Consulting / Remediation Support
Our PCI Customer Success team works closely with the customers in providing specific advisory support during the PCI DSS compliance and remediation phase. Our PCI Consultants have experience helping companies in Banking, Insurance, Payment Gateway, E-Commerce, Fintech, Travel Companies, and National and Regional Payment Switches to achieve PCI DSS compliance.
PCI Policies and Procedures
- Review existing policies
- Recommend new PCI policies
- Recommend new PCI procedures
Control Implementation Reviews
- Review of the controls implemented
- PCI Consultancy on new controls
- PCI segmentation implementation reviews
Facilitate PCI Services
- PCI Risk Assessment
- Track PCI implementation progress
- Periodic updates to the project team
- PCI Security Awareness training
PCI Penetration Tests & ASV Scans
- External ASV Scans & Pen testing
- PCI Internal VAPT
- Application PT & Source code reviews
- PCI Segmentation tests
PCI DSS QSA Audit
Upon successful PCI gap closures, customers can engage ValueMentor PCI QSA Auditors for the final PCI QSA Audit.
PCI Scope Validation
PCI QSA will revalidate the final scope (PCI CDE) and evaluates the changes from the initial one.
PCI QSA Onsite Audit
The PCI QSA will perform the testing procedures as defined in the ROC template provided by PCI Council on the scoped PCI environment.
PCI Report on Compliance (RoC)
- Collect and archive the evidence
- Document the findings as per the ROC
- Validation of the ROC by a QA QSA
- Release the ROC for customer review
PCI Certification / Attestation
- Prepare the Attestation of Compliance (AOC) based on client confirmation of ROC
- Attestation of Compliance by both parties
- Successfully concludes the PCI project.
