{"id":3772,"date":"2015-12-01T23:29:35","date_gmt":"2015-12-01T23:29:35","guid":{"rendered":"https:\/\/www.process.st\/templates\/pci-compliance-checklist\/"},"modified":"2024-02-28T16:09:00","modified_gmt":"2024-02-28T16:09:00","slug":"pci-compliance-checklist","status":"publish","type":"post","link":"https:\/\/www.process.st\/templates\/pci-compliance-checklist\/","title":{"rendered":"PCI Compliance Checklist"},"content":{"rendered":"
\n

Introduction<\/h2>\n
\n
\n <\/a>
\n <\/figure>\n<\/p><\/div>\n
\n

In this modern day and age it is more important than ever that all sensitive information is properly secure and protected. To that end, this checklist will take you through the steps to ensuring your complete compliance with Payment Card Industry Data Security Standards (PCI DSS).<\/p>\n

Although the official PCI DSS requires an annual review and submission of proof, it is recommended that you run this checklist at least quarterly (or after any changes in your system relating to cardholder data) to keep up to date on security.<\/p>\n

Follow this PCI compliance checklist to ensure complete compliance and avoid any legal trouble.<\/p>\n

Continue to tackle the first part of the process: <\/strong>Assessing.<\/p>\n

(Source: pcisecuritystandards.org<\/a>)<\/p>\n<\/p><\/div>\n<\/section>\n

\n

Assess:<\/h2>\n<\/section>\n
\n

Determine merchant level<\/h2>\n
\n

According to Search Security<\/a>, level 1 merchants must have their compliance assessed by a Qualified Security Assessor (QSA). The PCI Security Standards Council (PSISSC) has compiled a list of companies that can do it for you, available here<\/a>.<\/p>\n

While this is necessary for level 1 merchants, merchants at levels 2-4 can also call in the help of a QSA if they want to avoid extra work.<\/p>\n

(Source: pcicomplianceguide.org<\/a>)<\/p>\n<\/p><\/div>\n

\n
\n <\/a>
\n The merchant levels as defined by Visa.
\n <\/figcaption><\/figure>\n<\/p><\/div>\n<\/section>\n
\n

Decide if you need to comply<\/h2>\n
\n

According to Braintree<\/a>, "any business that processes, handles or stores credit card data on behalf of a merchant is required to be PCI DSS Compliant."<\/p>\n

Compliance Guide<\/a> adds:<\/p>\n

"PCI applies to ALL organizations or merchants, regardless of size or number of transactions, that accepts, transmits or stores any cardholder data. Said another way, if any customer of that organization ever pays the merchant directly using a credit card or debit card, then the PCI DSS requirements apply<\/strong>."<\/p>\n<\/p><\/div>\n<\/section>\n

\n

Work out the kind of assessment you should do<\/h2>\n
\n

How to determine your assessment level, along with the latest assessment forms, can be found in the document below:<\/p>\n<\/p><\/div>\n

\n

There are nine kinds<\/strong> of Self-Assessment Questionnaire (SAQ<\/strong>). The kind that applies to you dictates the level of compliance you need to meet. This table will tell you which SAQ classification you are:<\/p>\n<\/p><\/div>\n

\n
\n <\/a>
\n <\/figure>\n<\/p><\/div>\n
\n

When you move onto the next section, select the task appropriate to your SAQ level.<\/strong><\/p>\n

While the Remediate section<\/strong> of PCI Compliance contains general steps applicable to all merchants<\/strong>, the different SAQ levels might need you to have extra security measures in place.<\/p>\n<\/p><\/div>\n<\/section>\n

\n

SAQ:<\/h2>\n<\/section>\n
\n

SAQ A<\/h2>\n
\n

If you meet the requirements for SAQ A, as laid out in the previous task, this is the compliance form you must fill in.<\/p>\n<\/p><\/div>\n<\/section>\n

\n

SAQ A-EP<\/h2>\n
\n

If you meet the requirements for SAQ A-EP, as laid out in task 4, this is the compliance form you must fill in.<\/p>\n<\/p><\/div>\n<\/section>\n

\n

SAQ B<\/h2>\n
\n

If you meet the requirements for SAQ B, as laid out in task 4, this is the compliance form you must fill in.<\/p>\n<\/p><\/div>\n<\/section>\n

\n

SAQ B-IP<\/h2>\n
\n

If you meet the requirements for SAQ B-IP, as laid out in task 4, this is the compliance form you must fill in.<\/p>\n<\/p><\/div>\n<\/section>\n

\n

SAQ C-VT<\/h2>\n
\n

If you meet the requirements for SAQ C-VT, as laid out in task 4, this is the compliance form you must fill in.<\/p>\n<\/p><\/div>\n<\/section>\n

\n

SAQ C<\/h2>\n
\n

If you meet the requirements for SAQ C, as laid out in task 4, this is the compliance form you must fill in.<\/p>\n<\/p><\/div>\n<\/section>\n

\n

SAQ D-Merchant<\/h2>\n
\n

If you meet the requirements for SAQ D-Merchant, as laid out in task 4, this is the compliance form you must fill in.<\/p>\n<\/p><\/div>\n<\/section>\n

\n

SAQ D-Service Provider<\/h2>\n
\n

If you meet the requirements for SAQ D-Service Provider, as laid out in task 4, this is the compliance form you must fill in.<\/p>\n<\/p><\/div>\n<\/section>\n

\n

Remediate:<\/h2>\n
\n

Depending on the results of your self-assessment, you may have to carry out some or all of the below tasks before you are fully compliant with PCI requirements.<\/p>\n

If you are a level 1 merchant, you must use a certified QSA company and cannot carry out the steps yourself. A list of certified QSA firms can be found here<\/a>.<\/p>\n

If you prefer you can call in a QSA firm regardless of your merchant level, but know you don't have to.<\/p>\n

For each of the following tasks you must write and maintain documentation that explains the steps taken to comply. The documentation must be available to all relevant staff.<\/strong><\/p>\n<\/p><\/div>\n<\/section>\n

\n

Account for card brand variance<\/h2>\n
\n

Depending on the card brand<\/strong> you use, compliance procedures<\/strong> will be slightly different. See the links below for different company's policies on data security.<\/p>\n