Articles tagged regulatory compliance
12 Practices to Protect Card Data, and What PCI DSS v4.0.1 Asks for Each
The PCI Security Standards Council's twelve data security practices for small merchants, each set against the PCI DSS v4.0.1 requirements that make it specific: password length, patch deadlines, terminal inspections, scans and more.
Approved Scanning Vendors (ASVs): The Quarterly External Scan, Its Scope, and Choosing a Provider
What PCI DSS v4.0.1 Requirement 11.3.2 asks of external vulnerability scans, what the Approved Scanning Vendor decides and what stays with you, how to scope a scan, and what to ask an ASV before signing.
Do You Need a PCI DSS Audit? Here's How to Determine If and When
Who needs a formal PCI DSS assessment by a QSA and who can self-assess: what the SAQ instructions say, why merchant levels come from the payment brands, and what the standard asks for between assessments.
PCI Compliance 101: What PCI DSS v4.0.1 Is and How You Meet It
The basics of PCI DSS v4.0.1 for a business that takes cards: who it applies to, what counts as in scope, which card data may be stored, how compliance is validated, what changed in v4.x, and what has to happen between assessments.
PCI DSS Requirement 5.4.1: Protecting Personnel Against Phishing
What PCI DSS v4.0.1 Requirement 5.4.1 asks for: processes and automated mechanisms against phishing, who they must protect, how they are tested, where DMARC, SPF and DKIM fit, and how it differs from the phishing training in 12.6.3.1.
HSTS and PCI DSS: What HTTP Strict Transport Security Does for a Payment Site
What HTTP Strict Transport Security protects against, how it relates to PCI DSS v4.0.1 Requirements 4.2.1 and 11.6.1 even though the standard does not name it, and how to deploy it and the preload list without breaking a site.
How to Select a Qualified Security Assessor (QSA) for PCI DSS
What a QSA does and does not do, how to confirm a company is on the PCI Security Standards Council's list, what to ask before engaging one, and where to send feedback about an assessor.
Should my Service Provider be PCI Compliant?
The PCI Security Standards Council's answer: Requirement 12.8 does not make your service providers validate as compliant, but any requirement a provider meets for you counts in your assessment. What to ask for, what the standard asks of them, and how to record who does what.
PCI DSS Resources from the Council and the Payment Brands
Where to find the primary sources for PCI DSS: the standard and its documents, the Council's lists of assessors and validated products, its training programmes, and the payment brands' own compliance programmes.