PCI Compliance

In the IT world, audits are mandated for compliant organizations under State or Federal regulations (e.g., Banks, Credit Unions, Hospitals, Publicly Traded Companies). However, in  other cases, organizations can also be subjected to industry-specific requirements such as PCI-DSS (credit card payments).

PCI-DSS requires strict validation and compliance reports on a quarterly/annual basis.

SAQ stands for Self-Assessment Questionnaire, determined by factors such as transaction volume, payment acceptance methods (e.g., face-to-face, point of sale), and data storage methods.

To help simplify what SAQ your organization must complete, please refer to the table below.

Maintaining a Secure Network: A common misconception is that after conducting mandatory penetration testing and passing the ASV scan, compliance is indefinite. However, this is not true. Penetration testing and ASV scans provide a snapshot of current compliance levels. Businesses should continuously update software to maintain compliance.

Vulnerability Management: While an internal scan can be conducted by your IT department if they have the expertise, an external scan must be performed by a PCI SSC approved vendor like TSI. Additional scans are required for significant changes such as relocation or alterations to payment processing and network configurations.

Controlling Access: Storing data with each transaction creates identity theft risks, exposing your business's banking details. Any database or network device managing payment processes can undergo a PCI audit in cases of suspected fraud or negligence. Explore our PCI compliance guide for further insights.