Payment Card Industry (PCI) Data Security Standard
|
|
- Maurice Crawford
- 8 years ago
- Views:
Transcription
1 Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.0 February 2014
2 Section 1: Assessment Information Instructions for Submission This Attestation of Compliance must be completed as a declaration of the results of the service provider s assessment with the Payment Card Industry Data Security Standard Requirements and Security Assessment Procedures (PCI DSS). Complete all sections: The service provider is responsible for ensuring that each section is completed by the relevant parties, as applicable. Contact the requesting payment brand for reporting and submission procedures. Part 1. Service Provider and Qualified Security Assessor Information Part 1a. Service Provider Organization Information Company Name: Shift4 Corporation DBA (doing business as): Contact Name: JD Oder II Title: Founder, CTO, SVP Research & Development ISA Name(s) (if applicable): Title: Telephone: jd@shift4.com Business Address: 1491 Center Crossing Rd. City: Las Vegas State/Province: Nevada Country: USA Zip: URL: Part 1b. Qualified Security Assessor Company Information (if applicable) Company Name: Fishnet Security, Inc. Lead QSA Contact Name: Chad Barr Title: Sr. Security Consultant Telephone: Chad.Barr@fishnetsecurity.co m Business Address: 6130 Sprint Parkway, Suite 400 City: Overland Park State/Province: KS Country: USA Zip: URL: PCI Security Standards Council, LLC. All Rights Reserved. Page 1
3 Part 2. Executive Summary Part 2a. Scope Verification Services that were INCLUDED in the scope of the PCI DSS Assessment (check all that apply): Name of service(s) assessed: DOLLARS ON THE NET (DOTN ) Type of service(s) assessed: Hosting Provider: Applications / software Hardware Infrastructure / Network Physical space (co-location) Storage Web Security services 3-D Secure Hosting Provider Shared Hosting Provider Other Hosting (specify): Managed Services (specify): Systems security services IT support Physical security Terminal Management System Other services (specify): Payment Processing: POS / card present Internet / e-commerce MOTO / Call Center ATM Other processing (specify): Account Management Fraud and Chargeback Payment Gateway/Switch Back-Office Services Issuer Processing Prepaid Services Billing Management Loyalty Programs Records Management Clearing and Settlement Merchant Services Tax/Government Payments Network Provider Others (specify): Note: These categories are provided for assistance only, and are not intended to limit or predetermine an entity s service description. If you feel these categories don t apply to your service, complete Others. If you re unsure whether a category could apply to your service, consult with the applicable payment brand PCI Security Standards Council, LLC. All Rights Reserved. Page 2
4 Services that are provided by the service provider but were NOT INCLUDED in the scope of the PCI DSS Assessment (check all that apply): Name of service(s) not assessed: Type of service(s) not assessed: Hosting Provider: Applications / software Hardware Infrastructure / Network Physical space (co-location) Storage Web Security services 3-D Secure Hosting Provider Shared Hosting Provider Other Hosting (specify): N/A Managed Services (specify): Systems security services IT support Physical security Terminal Management System Other services (specify): Payment Processing: POS / card present Internet / e-commerce MOTO / Call Center ATM Other processing (specify): Account Management Fraud and Chargeback Payment Gateway/Switch Back-Office Services Issuer Processing Prepaid Services Billing Management Loyalty Programs Records Management Clearing and Settlement Merchant Services Tax/Government Payments Network Provider Others (specify): Provide a brief explanation why any checked services were not included in the assessment: Part 2b. Description of Payment Card Business Describe how and in what capacity your business stores, processes, and/or transmits cardholder data. Describe how and in what capacity your business is otherwise involved in or has the ability to impact the security of cardholder data. Shift4 supplies electronic payment card authorization, accounting, fraud detection and settlement services. Shift4 provides POS application tokenization and web application tokenization solutions for their merchant clients. N/A Part 2c. Locations List types of facilities and a summary of locations included in PCI DSS review (for example, retail outlets, corporate offices, data centers, call centers, etc.): Type of facility: Location(s) of facility (city, country): Shift4 Corporate Office Fire Mesa Data Center S7 (Switch) Data Center 1491 Center Crossing Rd, Las Vegas Nevada 2410 Fire Mesa Street, Las Vegas Nevada 7135 S. Decatur Blvd, Las Vegas Nevada PCI Security Standards Council, LLC. All Rights Reserved. Page 3
5 Part 2d. Payment Applications Does the organization use one or more Payment Applications? Yes No Provide the following information regarding the Payment Applications your organization uses: Payment Application Name Version Number Application Vendor Is application PA-DSS Listed? PA-DSS Listing Expiry date (if applicable) Universal Transacation Gateway (UTG ) 4Go with Universal Transaction Gateway (UTG ) Secure Suite 4 MICROS 3700 and 9700 with Universal Transaction Gateway (UTG ) 4.6 Shift4 Yes No 28 Oct Shift4 Yes No 28 Oct Shift4 Yes No 28 Oct 2016 Part 2e. Description of Environment Provide a high-level description of the environment covered by this assessment. For example: Connections into and out of the cardholder data environment (CDE). Critical system components within the CDE, such as POS devices, databases, web servers, etc., and any other necessary payment components, as applicable. Shift4 accepts Cardholder Data (CHD) into their environment for both Card-Present and Card-Not-Present credit transactions and also accepts Card-Present debit transactions. Shift4 acts as a value-added transaction payment gateway and provides a secure connection between merchant clients and their acquirer of record. Shift4 also provides extremely innovative customer applications allowing their merchant clients to have an extremely enhanced level of control over their transaction records and information. Shift4 s client offering is also a comprehensive accounting application that supports pre- and post-settlement auditing, batch settlements, and a 24-month archive of all transactions to help merchants simplify the accounting process and prevent against costly chargebacks. On the merchant side, Shift4 provides four PA-DSS v.2.0 validated API payment components to facilitate transactions. Currently, Shift4 has the following PCI SSC listed generic APIs for use at merchant client locations: 4Go with Universal Transaction Gateway (UTG ) Universal Transaction Gateway (UTG ) The 4Go and UTG APIs are designed to work with any multitude of customer POS systems and can be customized by Shift4 s integration team to accommodate any POS system running on these operating systems: Windows Vista SP PCI Security Standards Council, LLC. All Rights Reserved. Page 4
6 Windows 7 SP1 Windows 8/8.1 Windows Server 2008 SP2 Windows Server 2008 R2 Windows Server 2012 Shift4 also has two PCI SSC listed APIs for use at merchant locations where MICROS 3700 or 9700 POS systems are present: Secure Suite 4 MICROS 3700 with UTG Secure Suite 4 MICROS 9700 with UTG Shift4 merchant clients not using Shift4 APIs with their POS systems can use Shift4 s i4go technology. i4go can be used to accommodate ecommerce transactions and also works in a non-ecommerce environment if the merchant client s POS system is web-based. i4go utilizes TLSv1.2 connectivity over the Internet to connect to the Shift4 environment and securely process these transactions. Shift4 s transmission technologies, client tokenization solutions, and secure transaction processing environment ensure that CHD is secured and protected throughout the entire transaction process. Shift4 s Secure Transmission Methods: Shift4 has two secure transmission methods for their client s transactions: 1. Universal Transaction Gateway (UTG ) a clientside API that utilizes Shift4 s proprietary transmission technology known as Derived Unique Key Per Transaction with Moving Target Encryption (DUKPT w/mte) using three different PCI DSS defined strong encryption algorythms for transport of clients real-time transactional data. 2. i4go - browser-embedded client-side API that utilizes secure TLS 1.2 connectivity for the transport of clients real-time data. Shift4 s True-Tokenization Technology: Shift4 is the original innovator in tokenization technologies. Tokenization is accomplished as follows: 1. 4Go - Shift4 s patented API that runs at the driver level of client s POS systems and intercepts CHD at the swipe. CHD is replaced with either False Cardholder Data (FCHD) or a TrueToken. 4Go then utilizes UTG to transmit the actual CHD to Shift4 s DOTN environment. At this point, only FCHD or a TrueToken is then used to process the transaction within POS system. 2. i4go - at the point-of-sale, the merchant client or merchant client s customers enter their CHD directly into the merchant client s web application using the direct-post method into the integrated i4go form. The CHD is redirected from the browser to Shift4 s DOTN environment, so CHD never enters the browser based application or the host provider s environment (if present). i4go doesn t utilize PCI Security Standards Council, LLC. All Rights Reserved. Page 5
7 UTG for transmission; rather all actual CHD is transmitted back to the DOTN environment using TLS 1.2 connectivity. At this point, only a TrueToken is passed back to the merchant s web application and is then used to process the transaction within the web application or web-based POS system. Shift4 and Point-to-Point Encryption (P2PE): Shift4 s solution is completely compatible with any P2PE solutions available today. Shift4 solutions are all capable of having hardware-based P2PE bolted on top. Adding hardware-based P2PE without the use of 4Go will still provide Shift4 True Tokenization through the use of UTG, and for merchants using 4Go, P2PE adds an additional layer of security beyond what 4Go provides by encrypting the CHD as it is swiped so that it never even enters a merchant client s system in any exposed form. Shift4 also provides compatibility for mobile P2PE devices in an offering known as VT4. VT4 is accomplished through the use of approved P2PE-enabled swipe devices attached to a merchant client s mobile phone, tablet, etc. The swipe device will immediately encrypt the CHD, and pass it along to UTG for transmission to the DOTN environment. With all of these P2PE solutions, as long as the Shift4 merchant client has no ability to decrypt the data onsite, the entire merchant environment can be removed from scope. Only the P2PE device itself would be in-scope for PCI, and that scope is limited to physical protection. Shift4 s environment can support any form of P2PE; mobile, PIN transaction P2PE devices, and Magnetic Stripe Reader (MSR) devices Shift4 s Gateway Environment: The Shift4 DOTN environment is currently connected to several processors In North America including a direct connection to American Express. All storage of merchant CHD is housed securely in separate merchant databases residing in MS-SQL servers on internal network segments. All of the tokenized and/or transactional data in each merchant database is fully encrypted with PCI DSS defined strong encryption. Backups of all merchant data are via storage area network replication are also fully encrypted and remain under the control of Shift4 personnel at all times. It s important to note that debit transactions involving PIN/PVV/PIN-Block are facilitated by ensuring all PIN/PVV/PIN-Block data merely passes through the Shift4 environment from the merchant s originating POS/Debit system to the upstream service provider. All PIN/PVV/PINblock data remains encrypted and untouched end-to-end, from the merchant s POS system, through the Shift4 environment, and remains encrypted until it is received by the upstream processor. At no time does Shift4 manipulate, write, or decrypt the encrypted PIN/PVV/PIN-Block data PCI Security Standards Council, LLC. All Rights Reserved. Page 6
8 All transactions handled within the DOTN environment are processed via nineteen upstream processors including Shift4 s direct connection to American Express. The assessment activities included interviews and a review of the network focusing on the Shift4 Dollars-on-the-Net (DOTN) environment. As a part of this assessment, the following elements were investigated: The process and security controls surrounding the storage of cardholder data The security of system components transmitting cardholder data Overall information security policies and practices of Shift4 Does your business use network segmentation to affect the scope of your PCI DSS environment? (Refer to Network Segmentation section of PCI DSS for guidance on network segmentation) Yes No Part 2f. Third-Party Service Providers Does your company have a relationship with one or more third-party service providers (for example, gateways, payment processors, payment service providers (PSP), web-hosting companies, airline booking agents, loyalty program agents, etc.) for the purpose of the services being validated? Yes No If Yes: Type of service provider: Description of services provided: Note: Requirement 12.8 applies to all entities in this list PCI Security Standards Council, LLC. All Rights Reserved. Page 7
9 Part 2g. Summary of Requirements Tested For each PCI DSS Requirement, select one of the following: Full The requirement and all sub-requirements of that requirement were assessed, and no subrequirements were marked as Not Tested or Not Applicable in the ROC. Partial One or more sub-requirements of that requirement were marked as Not Tested or Not Applicable in the ROC. None All sub-requirements of that requirement were marked as Not Tested and/or Not Applicable in the ROC. For all requirements identified as either Partial or None, provide details in the Justification for Approach column, including: Details of specific sub-requirements that were marked as either Not Tested and/or Not Applicable in the ROC Reason why sub-requirement(s) were not tested or not applicable Note: One table to be completed for each service covered by this AOC. Additional copies of this section are available on the PCI SSC website. Name of Service Assessed: DOLLARS ON THE NET (DOTN ) PCI DSS Requirement Requirement 1: Requirement 2: Requirement 3: Requirement 4: Requirement 5: Full Partial None Details of Requirements Assessed Justification for Approach (Required for all Partial and None responses. Identify which sub-requirements were not tested and the reason.) No routers are in scope, all routing occurs within the firewalls No Wireless networks are in-scope No moble devices with direct connectivity to the Internet are allowed route access to the CDE. 2.1.x - No Wireless networks are in-scope No insecure services, daemons or protocols are used in the CDE Shift4 is not a shared hostng provider Shift4 does not store sensitive authentication data after authorization and is no an issuer or support issuing services Shift4 does not use Disk Level Encryption. 3.6.a - Shift4 does not share any encryption keys with 3 rd Parties Manual clear-text cryptographic keymanagement operations are not used No Wireless networks are in-scope No end-user messageing technologies are ever used to transmit cardholder data Shift4 is an all Windows shop and all systems are running the latest Anti-virus software. Requirement 6: PCI Security Standards Council, LLC. All Rights Reserved. Page 8
10 Requirement 7: Requirement 8: Requirement 9: No vendors or 3 rd parties are allowed remote access into the CDE No remote access is allowed to the CDE originating from outside the network Shift4 does not have access to customer premises No Wireless devices are in the CDE Shift4 performs no backup to external media Shift4 does not have any hard-copy material that would contain CHD. 9.9 Shift4 has no physical interfaces receiving CHD. Requirement 10: Requirement 11: Requirement 12: Appendix A: No internal environment that would require any form of penetration testing b - Penitration testing didn't include segmentation testing because of the Shift4 environment Vendors do not have remote access into the CDE Shift4 does not share CHD with 3 rd parties or services providers RoC was performed before June 30, Shift4 does have in their contracts Roles and Responsibilies for protecting CHD. Shift4 is not a shared hosting provider PCI Security Standards Council, LLC. All Rights Reserved. Page 9
11 Section 2: Report on Compliance This Attestation of Compliance reflects the results of an onsite assessment, which is documented in an accompanying Report on Compliance (ROC). The assessment documented in this attestation and in the ROC was completed on: Have compensating controls been used to meet any requirement in the ROC? Were any requirements in the ROC identified as being not applicable (N/A)? May 31, 2015 Yes Yes No No Were any requirements not tested? Yes No Were any requirements in the ROC unable to be met due to a legal constraint? Yes No PCI Security Standards Council, LLC. All Rights Reserved. Page 10
12 Section 3: Validation and Attestation Details Part 3. PCI DSS Validation Based on the results noted in the ROC dated May 31, 2015, the signatories identified in Parts 3b-3d, as applicable, assert(s) the following compliance status for the entity identified in Part 2 of this document as of May 31, 2015: (check one): Compliant: All sections of the PCI DSS ROC are complete, all questions answered affirmatively, resulting in an overall COMPLIANT rating; thereby Shift4 has demonstrated full compliance with the PCI DSS. Non-Compliant: Not all sections of the PCI DSS ROC are complete, or not all questions are answered affirmatively, resulting in an overall NON-COMPLIANT rating, thereby (Service Provider Company Name) has not demonstrated full compliance with the PCI DSS. Target Date for Compliance: An entity submitting this form with a status of Non-Compliant may be required to complete the Action Plan in Part 4 of this document. Check with the payment brand(s) before completing Part 4. Compliant but with Legal exception: One or more requirements are marked Not in Place due to a legal restriction that prevents the requirement from being met. This option requires additional review from acquirer or payment brand. If checked, complete the following: Affected Requirement Details of how legal constraint prevents requirement being met Part 3a. Acknowledgement of Status Signatory(s) confirms: (Check all that apply) The ROC was completed according to the PCI DSS Requirements and Security Assessment Procedures, Version 3.0, and was completed according to the instructions therein. All information within the above-referenced ROC and in this attestation fairly represents the results of my assessment in all material respects. I have confirmed with my payment application vendor that my payment system does not store sensitive authentication data after authorization. I have read the PCI DSS and I recognize that I must maintain PCI DSS compliance, as applicable to my environment, at all times. If my environment changes, I recognize I must reassess my environment and implement any additional PCI DSS requirements that apply PCI Security Standards Council, LLC. All Rights Reserved. Page 11
13 Part 3a. Acknowledgement of Status (continued) No evidence of full track data 1, CAV2, CVC2, CID, or CVV2 data 2, or PIN data 3 storage after transaction authorization was found on ANY system reviewed during this assessment. ASV scans are being completed by the PCI SSC Approved Scanning Vendor AppSec Consulting Part 3b. Service Provider Attestation J.D. Oder II (Jul 27, 2015) Signature of Service Provider Executive Officer Date: May 31, 2015 Service Provider Executive Officer Name: J.D. Oder II Title: CTO Part 3c. QSA Acknowledgement (if applicable) If a QSA was involved or assisted with this assessment, describe the role performed: Chad M Barr Chad M Barr (Jul 27, 2015) FishNet Security QSA (Chad Barr) reviewed ALL requirements to validate they are indeed "IN-PLACE". The QSA also reviewed all physical/logical evidence and visited all "in-scope" facilities. Signature of QSA Date: May 31, 2015 QSA Name: Chad Barr QSA Company: FishNet Security Part 3d. ISA Acknowledgement (if applicable) If an ISA was involved or assisted with this assessment, describe the role performed: Signature of ISA ISA Name: Date: Title: Data encoded in the magnetic stripe or equivalent data on a chip used for authorization during a card-present transaction. Entities may not retain full track data after transaction authorization. The only elements of track data that may be retained are primary account number (PAN), expiration date, and cardholder name. The three- or four-digit value printed by the signature panel or on the face of a payment card used to verify card-not-present transactions. Personal identification number entered by cardholder during a card-present transaction, and/or encrypted PIN block present within the transaction message PCI Security Standards Council, LLC. All Rights Reserved. Page 12
14 Part 4. Action Plan for Non-Compliant Requirements Select the appropriate response for Compliant to PCI DSS Requirements for each requirement. If you answer No to any of the requirements, you may be required to provide the date your Company expects to be compliant with the requirement and a brief description of the actions being taken to meet the requirement. Check with the applicable payment brand(s) before completing Part 4. PCI DSS Requirement Description of Requirement Compliant to PCI DSS Requirements (Select One) YES NO Remediation Date and Actions (If NO selected for any Requirement) 1 Install and maintain a firewall configuration to protect cardholder data 2 Do not use vendor-supplied defaults for system passwords and other security parameters 3 Protect stored cardholder data Encrypt transmission of cardholder data across open, public networks Protect all systems against malware and regularly update antivirus software or programs Develop and maintain secure systems and applications Restrict access to cardholder data by business need to know Identify and authenticate access to system components Restrict physical access to cardholder data Track and monitor all access to network resources and cardholder data Regularly test security systems and processes Maintain a policy that addresses information security for all personnel PCI Security Standards Council, LLC. All Rights Reserved. Page 13
15 Shift PCI DSS v3 AOC Adobe Document Cloud Document History July 27, 2015 Created: July 27, 2015 By: Status: Transaction ID: Chad Barr SIGNED XQH4FRKXT3G6I4B Shift PCI DSS v3 AOC History Document created by Chad M Barr (chad.barr@fishnetsecurity.com) July 27, :58 AM PDT - IP address: Document ed to J.D. Oder II (jd@shift4.com) for signature July 27, :59 AM PDT Document viewed by J.D. Oder II (jd@shift4.com) July 27, :29 AM PDT - IP address: Document e-signed by J.D. Oder II (jd@shift4.com) Signature Date: July 27, :30 AM PDT - Time Source: server - IP address: Document ed to Chad M Barr (chad.barr@fishnetsecurity.com) for signature July 27, :30 AM PDT Document viewed by Chad M Barr (chad.barr@fishnetsecurity.com) July 27, :33 AM PDT - IP address: Document e-signed by Chad M Barr (chad.barr@fishnetsecurity.com) Signature Date: July 27, :35 AM PDT - Time Source: server - IP address: Signed document ed to J.D. Oder II (jd@shift4.com) and Chad M Barr (chad.barr@fishnetsecurity.com) July 27, :35 AM PDT
Payment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Self-Assessment Questionnaire D Service Providers For use with PCI DSS Version 3.1 Revision 1.1 July 2015 Section 1: Assessment
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.0 February 2014 Section 1: Assessment Information Instructions for Submission
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Standard Attestation of Compliance for Self-Assessment Questionnaire D Service Providers Version 3.1 April 2015 Section 1: Assessment Information Instructions for Submission
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.1 April 2015 Section 1: Assessment Information Instructions for Submission
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.0 February 2014 Section 1: Assessment Information Instructions for Submission
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.0 February 2014 Section 1: Assessment Information Instructions for Submission
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.0 February 2014 Section 1: Assessment Information Instructions for Submission
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.0 February 2014 Section 1: Assessment Information Instructions for Submission
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.0 February 2014 Section 1: Assessment Information Instructions for Submission
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.0 February 2014 Section 1: Assessment Information Instructions for Submission
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.1 April 2015 Section 1: Assessment Information Instructions for Submission
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.1 April 2015 Section 1: Assessment Information Instructions for Submission
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.0 February 2014 Section 1: Assessment Information Instructions for Submission
More informationAttestation of Compliance for Onsite Assessments Service Providers
Attestation of Compliance Service Providers Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 2.0 October 2010 Instructions for
More informationSection 1: Assessment Information
Section 1: Assessment Information Instructions for Submission This document must be completed as a declaration of the results of the service provider s self-assessment with the Payment Card Industry Data
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A and Attestation of Compliance Card-not-present Merchants, All Cardholder Data Functions Fully Outsourced Version 3.0 February
More informationAttestation of Compliance for Onsite Assessments Service Providers
Attestation of Compliance Service Providers Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 2.0 October 2010 Instructions for
More informationAttestation of Compliance for Onsite Assessments Service Providers
Attestation of Compliance Service Providers Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 2.0 October 2010 Instructions for
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 3.1 April 2015 Section 1: Assessment Information Instructions for Submission
More informationAttestation of Compliance for Onsite Assessments Service Providers
Attestation of Compliance Service Providers Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Onsite Assessments Service Providers Version 2.0 October 2010 Instructions for
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance All other SAQ-Eligible Merchants and Service Providers Version 2.0 October 2010 Document
More informationPayment Card Industry (PCI) Data Security Standard. Attestation of Compliance for Self-Assessment Questionnaire C-VT. Version 2.0
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Self-Assessment Questionnaire C-VT Version 2.0 October 2010 Attestation of Compliance, SAQ C-VT Instructions for Submission
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire B and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire B and Attestation of Compliance Merchants with Only Imprint Machines or Only Standalone, Dial-out Terminals Electronic Cardholder
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire C-VT and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire C-VT and Attestation of Compliance Merchants with Web-Based Virtual Payment Terminals No Electronic Cardholder Data Storage
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire B and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire B and Attestation of Compliance Imprint Machines or Stand-alone Dial-out Terminals Only, no Electronic Cardholder Data Storage
More informationPayment Card Industry (PCI) Data Security Standard ROC Reporting Instructions for PCI DSS v2.0
Payment Card Industry (PCI) Data Security Standard ROC Reporting Instructions for PCI DSS v2.0 September 2011 Changes Date September 2011 Version Description 1.0 To introduce PCI DSS ROC Reporting Instructions
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire C and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire C and Attestation of Compliance Payment Application Connected to Internet, No Electronic Cardholder Data Storage Version
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire C-VT and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire C-VT and Attestation of Compliance Merchants with Web-Based Virtual Payment Terminals No Electronic Cardholder Data Storage
More informationPayment Application Data Security Standard
Payment Card Industry (PCI) Payment Application Data Security Standard ROV Reporting Instructions for PA-DSS v2.0 March 2012 Changes Date March 2012 Version Description Pages 1.0 To introduce PA-DSS ROV
More informationBecoming PCI Compliant
Becoming PCI Compliant Jason Brown - brownj52@michigan.gov Enterprise Security Architect Enterprise Architecture Department of Technology, Management and Budget State of Michigan @jasonbrown17 History
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance for Service Providers
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance for Service Providers SAQ-Eligible Service Providers Version 3.0 February 2014 Document
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance All other SAQ-Eligible Merchants and Service Providers Version 2.0 October 2010 Document
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance All other SAQ-Eligible Merchants and Service Providers Version 2.0 October 2010 Document
More informationCase 2:13-cv-01887-ES-JAD Document 282-2 Filed 12/09/15 Page 1 of 116 PageID: 4879. Appendix A
Case 2:13-cv-01887-ES-JAD Document 282-2 Filed 12/09/15 Page 1 of 116 PageID: 4879 Appendix A Case 2:13-cv-01887-ES-JAD Document 282-2 Filed 12/09/15 Page 2 of 116 PageID: 4880 Payment Card Industry (PCI)
More informationPayment Card Industry (PCI) Data Security Standard Report on Compliance. Template for Report on Compliance for use with PCI DSS v3.0. Version 1.
Payment Card dustry (PCI) Data Security Standard Report on Compliance Template for Report on Compliance for use PCI DSS v3.0 Version 1.0 February 2014 Document Changes Date Version Description February
More informationPCI DSS Compliance. 2015 Information Pack for Merchants
PCI DSS Compliance 2015 Information Pack for Merchants This pack contains general information regarding PCI DSS compliance and does not take into account your business' particular requirements. ANZ recommends
More informationCredit Card Processing Overview
CardControl 3.0 Credit Card Processing Overview Overview Credit card processing is a very complex and important system for anyone that sells goods. This guide will hopefully help educate and inform new
More informationCardControl. Credit Card Processing 101. Overview. Contents
CardControl Credit Card Processing 101 Overview Credit card processing is a very complex and important system for anyone that sells goods. This guide will hopefully help educate and inform new and old
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Attestation of Compliance for Self-Assessment Questionnaire A Version 2.0 Attestation Of Compliance, SAQ A Instructions for Submission The merchant must
More informationQualified Integrators and Resellers (QIR) Implementation Statement
Qualified Integrators and Resellers (QIR) Implementation Statement For each Qualified Installation performed, the QIR Employee must complete this document and confirm whether the validated payment application
More informationPCI DSS 3.0 Overview. OSU Business Affairs Business Affairs PIT Crew - Project, Improvement, & Technology Robin Whitlock
PCI DSS 3.0 Overview OSU Business Affairs Business Affairs PIT Crew - Project, Improvement, & Technology Robin Whitlock 01/16/2015 Purpose of Today s Presentation To provide an overview of PCI 3.0 based
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance All other Merchants and all SAQ-Eligible Service Providers Version 1.2 October 2008 Document
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire Instructions and Guidelines Version 3.2 May 2016 Document Changes Date Version Description October 1, 2008 1.2 October 28,
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire C and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire C and Attestation of Compliance Merchants with Payment Application Systems Connected to the Internet No Electronic Cardholder
More informationAdyen PCI DSS 3.0 Compliance Guide
Adyen PCI DSS 3.0 Compliance Guide February 2015 Page 1 2015 Adyen BV www.adyen.com Disclaimer: This document is for guidance purposes only. Adyen does not accept responsibility for any inaccuracies. Merchants
More informationAttestation of Compliance, SAQ A
Attestation of Compliance, SAQ A Instructions for Submission The merchant must complete this Attestation of Compliance as a declaration of the merchant s compliance status with the Payment Card Industry
More informationThoughts on PCI DSS 3.0. September, 2014
Thoughts on PCI DSS 3.0 September, 2014 Speaker Today Jeff Sanchez is a Managing Director in Protiviti s Los Angeles office. He joined Protiviti in 2002 after spending 10 years with Arthur Andersen s Technology
More informationKey Steps to Meeting PCI DSS 2.0 Requirements Using Sensitive Data Discovery and Masking
Key Steps to Meeting PCI DSS 2.0 Requirements Using Sensitive Data Discovery and Masking SUMMARY The Payment Card Industry Data Security Standard (PCI DSS) defines 12 high-level security requirements directed
More informationPayment Card Industry (PCI) Data Security Standard. Requirements and Security Assessment Procedures. Version 3.1 April 2015
Payment Card Industry (PCI) Data Security Standard Requirements and Security Assessment Procedures Version 3.1 April 2015 Document Changes Date Version Description Pages October 2008 1.2 July 2009 1.2.1
More informationTemplate for PFI Final Incident Report for Remote Investigations
Payment Card Industry (PCI) Data Security Standard PFI Final Incident Report for Remote Investigations Template for PFI Final Incident Report for Remote Investigations Version 1.1 February 2015 Document
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Requirements and Security Assessment Procedures Version 2.0 October 2010 Document Changes Date Version Description Pages October 2008 July 2009 October
More informationPuzzled about PCI compliance? Proactive ways to navigate through the standard for compliance
Puzzled about PCI compliance? Proactive ways to navigate through the standard for compliance March 29, 2012 1:00 p.m. ET If you experience any technical difficulties, please contact 888.228.0988 or support@learnlive.com
More informationUNLV Payment Card Merchant Policy Credit Card Handling Responsibilities and Procedures
UNLV Payment Card Merchant Policy Credit Card Handling Responsibilities and Procedures Background Colleges and universities have traditionally had open networks of information that foster the exchange
More informationPCI DSS FAQ. The twelve requirements of the PCI DSS are defined as follows:
What is PCI DSS? PCI DSS is an acronym for Payment Card Industry Data Security Standards. PCI DSS is a global initiative intent on securing credit and banking transactions by merchants & service providers
More informationPayment Card Industry (PCI) Data Security Standard
Payment Card Industry (PCI) Data Security Standard Requirements and Security Assessment Procedures Version 1.2.1 July 2009 Document Changes Date Version Description Pages October 2008 July 2009 1.2 1.2.1
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance All other Merchants and all SAQ-Eligible Service Providers Version 1.1 February 2008 Table
More informationSo you want to take Credit Cards!
So you want to take Credit Cards! Payment Card Industry - Data Security Standard: (PCI-DSS) Doug Cox GSEC, CPTE, PCI/ISA, MBA dcox@umich.edu Data Security Analyst University of Michigan PCI in Higher Ed
More informationPCI DSS Gap Analysis Briefing
PCI DSS Gap Analysis Briefing The University of Chicago October 1, 2012 Walter Conway, QSA 403 Labs, LLC Agenda The PCI DSS ecosystem - Key players, roles - Cardholder data - Merchant levels and SAQs UofC
More informationPayment Card Industry Data Security Standards
Payment Card Industry Data Security Standards Discussion Objectives Agenda Introduction PCI Overview and History The Protiviti Difference Questions and Discussion 2 2014 Protiviti Inc. CONFIDENTIAL: This
More informationUnderstanding the SAQs for PCI DSS version 3
Understanding the SAQs for PCI DSS version 3 The PCI DSS self-assessment questionnaires (SAQs) are validation tools intended to assist merchants and service providers report the results of their PCI DSS
More informationPCI Compliance at The University of South Carolina. Failure is not an option. Rick Lambert PMP University of South Carolina ricklambert@sc.
PCI Compliance at The University of South Carolina Failure is not an option Rick Lambert PMP University of South Carolina ricklambert@sc.edu Payment Card Industry Data Security Standard (PCI DSS) Who Must
More informationFrequently Asked Questions
Contents CISP Program Overview... 2 1. To whom does CISP apply?...2 2. What does VISA define as "cardholder data"?...2 3. What if a merchant or service provider does not store Visa cardholder data?...2
More informationHow To Complete A Pci Ds Self Assessment Questionnaire
Department PCI Self-Assessment Questionnaire Version 1.1 2009 Attestation of Compliance Instructions for Submission This Department PCI Self-Assessment Questionnaire has been developed as an assessment
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A-EP and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire A-EP and Attestation of Compliance Partially Outsourced E-commerce Merchants Using a Third-Party Website for Payment Processing
More informationPayment Card Industry (PCI) Data Security Standard PFI Final Incident Report. Template for PFI Final Incident Report. Version 1.0.
Payment Card Industry (PCI) Data Security Standard PFI Final Incident Report Template for PFI Final Incident Report Version 1.0 August 2014 Document Changes Date Version Description August 2014 1.0 To
More informationPayment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire P2PE-HW and Attestation of Compliance
Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire P2PE-HW and Attestation of Compliance Hardware Payment Terminals in a Validated P2PE Solution only, No Electronic Cardholder
More informationPayment Card Industry (PCI) Data Security Standard. Requirements and Security Assessment Procedures. Version 3.0 November 2013
Payment Card Industry (PCI) Data Security Standard Requirements and Security Assessment Procedures Version 3.0 November 2013 Document Changes Date Version Description Pages October 2008 1.2 July 2009 1.2.1
More informationPCI Compliance. How to Meet Payment Card Industry Compliance Standards. May 2015. cliftonlarsonallen.com. 2015 CliftonLarsonAllen LLP
2015 CliftonLarsonAllen LLP PCI Compliance How to Meet Payment Card Industry Compliance Standards May 2015 cliftonlarsonallen.com Overview PCI DSS In the beginning Each major card brand had its own separate
More informationAre You Ready For PCI v 3.0. Speaker: Corbin DelCarlo Institution: McGladrey LLP Date: October 6, 2014
Are You Ready For PCI v 3.0 Speaker: Corbin DelCarlo Institution: McGladrey LLP Date: October 6, 2014 Today s Presenter Corbin Del Carlo QSA, PA QSA Director, National Leader PCI Services Practice 847.413.6319
More informationNorth Carolina Office of the State Controller Technology Meeting
PCI DSS Security Awareness Training North Carolina Office of the State Controller Technology Meeting April 30, 2014 agio.com A Note on Our New Name Secure Enterprise Computing was acquired as the Security
More informationPayment Card Industry (PCI) Data Security Standard PFI Final Incident Report. Template for PFI Final Incident Report. Version 1.1.
Payment Card Industry (PCI) Data Security Standard PFI Final Incident Report Template for PFI Final Incident Report Version 1.1 February 2015 Document Changes Date Version Description August 2014 1.0 To
More informationPCI Compliance Overview
PCI Compliance Overview 1 PCI DSS Payment Card Industry Data Security Standard Standard that is applied to: Merchants Service Providers (Banks, Third party vendors, gateways) Systems (Hardware, software)
More informationTREASURER S OFFICE ADMINISTRATIVE STANDARDS FOR THE TREASURER S FISCAL PROCEDURE No. 08-01 MERCHANT DEBIT AND CREDIT CARD RECEIPTS
TREASURER S OFFICE ADMINISTRATIVE STANDARDS FOR THE TREASURER S FISCAL PROCEDURE No. 08-01 MERCHANT DEBIT AND CREDIT CARD RECEIPTS 1. Introduction Debit and Credit Card Receipt Standards apply to the administration
More informationInformation Technology
Credit Card Handling Security Standards Overview Information Technology This document is intended to provide guidance to merchants (colleges, departments, organizations or individuals) regarding the processing
More informationPCI DSS Overview. By Kishor Vaswani CEO, ControlCase
PCI DSS Overview By Kishor Vaswani CEO, ControlCase Agenda About PCI DSS PCI DSS Applicability to Banks, Merchants and Service Providers PCI DSS Technical Requirements Overview of PCI DSS 3.0 Changes Key
More informationHow Secure is Your Payment Card Data?
How Secure is Your Payment Card Data? Complying with PCI DSS SLIDE 1 PRESENTERS Francis Tam, CPA, CISA, CISM, CITP, CRISC, PCI QSA Managing Director, IT Security Practice PCI Practice Leader Francis has
More informationPCI Compliance : What does this mean for the Australian Market Place? Nov 2007
Sense of Security Pty Ltd (ABN 14 098 237 908) 306, 66 King St Sydney NSW 2000 Australia Tel: +61 (0)2 9290 4444 Fax: +61 (0)2 9290 4455 info@senseofsecurity.com.au PCI Compliance : What does this mean
More informationPayment Card Industry (PCI) Data Security Standard. Summary of Changes from PCI DSS Version 1.2.1 to 2.0
Payment Card Industry (PCI) Data Security Standard Summary of s from PCI DSS Version 1.2.1 to 2.0 October 2010 General General Throughout Removed specific references to the Glossary as references are generally
More informationPCI Compliance 3.1. About Us
PCI Compliance 3.1 University of Hawaii About Us Helping organizations comply with mandates, recover from security breaches, and prevent data theft since 2000. Certified to conduct all major PCI compliance
More informationPayment Card Industry Data Security Standard Self-Assessment Questionnaire B-IP Guide
Payment Card Industry Data Security Standard Self-Assessment Questionnaire B-IP Guide Prepared for: University of Tennessee Merchants 26 August 2015 Prepared by: University of Tennessee System Administration
More informationFrequently Asked Questions
PCI Compliance Frequently Asked Questions Table of Content GENERAL INFORMATION... 2 PAYMENT CARD INDUSTRY DATA SECURITY STANDARD (PCI DSS)...2 Are all merchants and service providers required to comply
More informationAIS Webinar. Payment Application Security. Hap Huynh Business Leader Visa Inc. 1 April 2009
AIS Webinar Payment Application Security Hap Huynh Business Leader Visa Inc. 1 April 2009 1 Agenda Security Environment Payment Application Security Overview Questions and Comments Payment Application
More informationThoughts on PCI DSS 3.0. D. Timothy Hartzell CISSP, CISM, QSA, PA-QSA Associate Director
Thoughts on PCI DSS 3.0 D. Timothy Hartzell CISSP, CISM, QSA, PA-QSA Associate Director Agenda 1 2 3 Global Payment Card Statistics and Trends PCI DSS Overview PCI DSS Version 3.0: Important Timelines
More informationAISA Sydney 15 th April 2009
AISA Sydney 15 th April 2009 Where PCI stands today: Who needs to do What, by When Presented by: David Light Sense of Security Pty Ltd Agenda Overview of PCI DSS Compliance requirements What & When Risks
More informationPCI DSS 3.0 Changes Bill Franklin Executive IT Auditor bfranklin@compassitc.com January 23, 2014
PCI DSS 3.0 Changes Bill Franklin Executive IT Auditor bfranklin@compassitc.com January 23, 2014 Agenda Introduction PCI DSS 3.0 Changes What Can I Do to Prepare? When Do I Need to be Compliant? Questions
More informationYour Compliance Classification Level and What it Means
General Information What are the Payment Card Industry (PCI) Data Security Standards? The PCI Data Security Standards represents a common set of industry tools and measurements to help ensure the safe
More informationPDQ Guide for the PCI Data Security Standard Self-Assessment Questionnaire C (Version 1.1)
PDQ has created an Answer Guide for the Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire C to help wash operators complete questionnaires. Part of the Access Customer Management
More informationThis appendix is a supplement to the Local Government Information Security: Getting Started Guide, a non-technical reference essential for elected
This appendix is a supplement to the Local Government Information Security: Getting Started Guide, a non-technical reference essential for elected officials, administrative officials and business managers.
More informationINFORMATION TECHNOLOGY FLASH REPORT
INFORMATION TECHNOLOGY FLASH REPORT Understanding PCI DSS Version 3.0 Key Changes and New Requirements November 8, 2013 On November 7, 2013, the PCI Security Standards Council (PCI SSC) announced the release
More informationTechnology Innovation Programme
FACT SHEET Technology Innovation Programme The Visa Europe Technology Innovation Programme () was designed to complement the Payment Card Industry (PCI) Data Security Standard (DSS) by reflecting the risk
More informationPCI PA - DSS. Point ipos Implementation Guide. Version 1.01. VeriFone Vx820 using the Point ipos Payment Core
PCI PA - DSS Point ipos Implementation Guide VeriFone Vx820 using the Point ipos Payment Core Version 1.01 POINT TRANSACTION SYSTEMS AB Box 92031, 120 06 Stockholm, Tel. +46 8 566 287 00 www.point.se Page
More informationPCI PA - DSS. Point XSA Implementation Guide. Atos Worldline Banksys XENTA SA. Version 1.00
PCI PA - DSS Point XSA Implementation Guide Atos Worldline Banksys XENTA SA Version 1.00 POINT TRANSACTION SYSTEMS AB Box 92031, 120 06 Stockholm, Tel. +46 8 566 287 00 www.point.se Page number 2 (16)
More informationPCI Compliance. What is New in Payment Card Industry Compliance Standards. October 2015. cliftonlarsonallen.com. 2015 CliftonLarsonAllen LLP
cliftonlarsonallen.com PCI Compliance What is New in Payment Card Industry Compliance Standards October 2015 Overview PCI DSS In the beginning Each major card brand had its own separate criteria for implementing
More informationEncryption and Tokenization: Protecting Customer Data. Your Payments Universally Amplified. Tia D. Ilori Sue Zloth September 18, 2013
Encryption and Tokenization: Protecting Customer Data Your Payments Universally Amplified Tia D. Ilori Sue Zloth September 18, 2013 Agenda Global Threat Landscape Real Cost of a Data Breach Evolution of
More informationJosiah Wilkinson Internal Security Assessor. Nationwide
Josiah Wilkinson Internal Security Assessor Nationwide Payment Card Industry Overview PCI Governance/Enforcement Agenda PCI Data Security Standard Penalties for Non-Compliance Keys to Compliance Challenges
More informationWhy Is Compliance with PCI DSS Important?
Why Is Compliance with PCI DSS Important? The members of PCI Security Standards Council (American Express, Discover, JCB, MasterCard, and Visa) continually monitor cases of account data compromise. These
More informationProject Title slide Project: PCI. Are You At Risk?
Blank slide Project Title slide Project: PCI Are You At Risk? Agenda Are You At Risk? Video What is the PCI SSC? Agenda What are the requirements of the PCI DSS? What Steps Can You Take? Available Services
More informationUnderstanding Payment Card Industry (PCI) Data Security
Understanding Payment Card Industry (PCI) Data Security Office of the State Controller November 2010 State of North Carolina The Enemy Major Security Breaches TJ-Max Heartland Hannaford Foods BJ s Wholesale
More informationPayment Card Industry Data Security Standard (PCI DSS)
Payment Card Industry Data Security Standard (PCI DSS) What is PCI SSC? A 12 year old independent industry standards body providing oversight of the development and management of Payment Card Industry
More informationCyber Security: Secure Credit Card Payment Process Payment Card Industry Standard Compliance
Cyber Security: Secure Credit Card Payment Process Payment Card Industry Standard Compliance A Non-Technical Guide Essential for Business Managers Office Managers Operations Managers Compliant? Bank Name
More information