The Payment Card Industry Standard is changing, are you ready? Learn about PCI DSS v4.0 here.

The release of PCI DSS v4.0 introduced several changes to validating and reporting compliance.

There are several fundamental compliance validation actions that organizations complete – some of which include:

1. Meet all applicable requirements: Producing recorded evidence that all applicable requirements set out by the PCI SSC are met.
   
   
2. Establish and maintain a secure environment: Establish a cardholder data environment (CDE) that meets all the applicable baseline security requirements as specified within the PCI Data Security Standard. The CDE is comprised of all system components, people, and processes that store, process, or transmit CHD or sensitive authentication data and/or system components that may not store, process, or transmit CHD or sensitive authentication data (SAD but have unrestricted connectivity to system components that store, process, or transmit CHD/SAD.
   
   
3. Network security assessments: Perform a series of security vulnerability scans of the network and applications. This technical exercise requires the help of outside firms that are designated Authorized Scan Vendors (ASVs). An ASV is a data security firm using a scanning solution to determine whether or not the customer meets the PCI DSS external vulnerability scanning requirement. ASVs are qualified by the PCI Security Standards Council to perform external network and system scans as required by the PCI DSS. ASVs use a remote tool to detect any vulnerabilities or data security risks in the scanned organization’s systems. These scans must be performed on a quarterly basis (once every 90 days). Here is a list of ASV vendors approved by PCI SSC.
   
   Almost all merchants must undergo a scan, regardless of applicable compliance level. However, some merchants who complete a self-assessment questionnaire (SAQ) might be exempt, based on the same subclassification used to select the appropriate SAQ form. Specifically, entities qualifying for SAQ A-EP, B-IP, C, and D (merchant or service provider) are all obligated to pass the vulnerability scan requirement while SAQ A, B, C-VT, and PEPE-HW are not.
   
   
4. Environment security assessment: Complete an assessment that shows the level of security for a business's systems and practices. Depending on assessment and reporting levels, as well as other criteria, it may be required for assessments to be conducted by a Qualified Security Assessor. A Qualified Security Assessor (QSA) is an individual certified by the PCI SSC to validate another entity's PCI DSS compliance. QSAs must be employed and sponsored by a QSA Company, which also must be certified by the PCI Security Standards Council.
   
   The PCI DSS includes more than 400 compliance validation testing procedures. Some assessments may be conducted by Internal Security Assessors (ISAs). An ISA is an individual who has earned a certificate from the PCI Security Standards Company for their sponsoring organization, and can conduct PCI security self-assessments for their organization.
   
   
5. Compliance reporting: Complete and submit a compliance report. PCI DSS validation reports are the official mechanism by which merchants and other entities report their PCI DSS compliance status to their respective acquiring financial institutions or payment card brand. Depending on the applicable compliance reporting and validation levels, this will either be a self-assessment questionnaire (SAQ) or a report on compliance (ROC). Each report is accompanied by a completed and signed attestation of compliance (AOC) form – as described below. 

• Compliance validation reporting requirements
  All organizations that are required to validate PCI DSS compliance need to complete and submit a set of compliance validation reporting documents. Merchants and service providers need to complete a report on compliance (ROC), and those that do not need a ROC will complete a self-assessment questionnaire (SAQ). If an organization’s assessment confirms compliance with DSS requirements, or if it shows failure, the organization must complete and submit an Attestation of Compliance (AOC). 
• PCI DSS self-assessments
  Organizations with relatively low payment card transaction volumes typically perform a self-assessment and report their compliance status using one of the applicable SAQs. While SAQs mainly apply to small merchants, some service providers may be defined by a payment brand as eligible to complete an SAQ (“SAQ D for Service Providers”). There are seven different types of SAQ forms that can be used to assess PCI DSS compliance and CHD security – depending on the needs of different merchant and service provider environments.

The Quick Reference Guide to the PCI Data Security Standard (PCI DSS) is provided by the PCI SSC to inform and educate merchants and other entities involved in payment card processing.