WEBVTT 00:00:00.840 --> 00:00:02.340 In all the talk about contracts, 00:00:02.350 --> 00:00:06.260 we didn't mention the role of the PCI SSC, and that's because they 00:00:06.260 --> 00:00:09.360 don't have one, and this is the crucial point. 00:00:09.840 --> 00:00:13.450 The PCI SSC is a standards body. 00:00:13.780 --> 00:00:18.710 It just developed and maintains the standards. The card 00:00:18.710 --> 00:00:24.060 schemes, via their acquirers, tell organizations, and I guess 00:00:24.130 --> 00:00:25.610 if you're interested in this course, 00:00:25.610 --> 00:00:29.870 the organization where you work, the card schemes via their 00:00:29.870 --> 00:00:33.530 acquirers tell organizations to comply with one of the 00:00:33.530 --> 00:00:36.860 standards that the PCI SSC writes. 00:00:37.440 --> 00:00:41.880 So, a card scheme makes a merchant comply with PCI DSS via 00:00:41.880 --> 00:00:44.160 the scheme's contract with the acquirers. 00:00:44.940 --> 00:00:48.990 The PCI SSC writes and maintains PCI DSS. 00:00:49.940 --> 00:00:53.140 A card scheme will make sure that service providers to 00:00:53.140 --> 00:00:58.090 merchants also comply with PCI DSS via the schemes contract 00:00:58.090 --> 00:01:02.230 with acquirers, and their contracts with merchants. And the PCI 00:01:02.230 --> 00:01:05.450 SSC writes and maintains PCI DSS. 00:01:06.540 --> 00:01:11.780 A card scheme will make an acquirer comply with PCI PIN, and the PCI 00:01:11.780 --> 00:01:15.580 SSC writes and maintains the PCI PIN standard. 00:01:17.040 --> 00:01:24.360 The card scheme may make merchants only use PCI PTS POI validated devices, 00:01:24.390 --> 00:01:27.630 which it would enforce through its contract with acquirers, 00:01:27.640 --> 00:01:32.420 saying to the acquiree your merchants must use these devices, and the 00:01:32.420 --> 00:01:37.750 PCI SSC writes and maintains the PCI PTS POI standard. 00:01:38.440 --> 00:01:41.430 And this is really important. Because let's say you get to a 00:01:41.430 --> 00:01:45.120 place where, for some reason, it's impossible for you to comply 00:01:45.120 --> 00:01:47.460 with one of the requirements of PCI DSS. 00:01:48.440 --> 00:01:52.550 It isn't the PCI SSC who you need to talk to. 00:01:53.040 --> 00:01:57.910 It is the organization that is contractually asking you to comply, and 00:01:57.910 --> 00:02:00.560 if you're a merchant, that's usually your acquirer. 00:02:01.140 --> 00:02:05.030 So, if the schemes make organizations comply with the 00:02:05.030 --> 00:02:06.810 standards that the PCI SSC writes, 00:02:07.740 --> 00:02:13.420 what else does the PCI SSC do, as well as writing standards? There 00:02:13.420 --> 00:02:17.260 are two other main activities that have some effect on how your 00:02:17.260 --> 00:02:19.060 organization will process payments. 00:02:20.340 --> 00:02:24.400 The first is they train and certify assessors who are able to validate 00:02:24.400 --> 00:02:26.890 that an organization is compliant with the standard, 00:02:26.900 --> 00:02:32.710 such as PCI DSS. Or assessors who can validate that products or software or 00:02:32.710 --> 00:02:36.130 solutions are also compliant with the relevant standards, 00:02:36.130 --> 00:02:41.230 such as the software security standard. Because some of the PCI 00:02:41.230 --> 00:02:46.120 standards are for hardware, the PCI SCC also accredits specialist 00:02:46.120 --> 00:02:49.720 laboratories that have the facilities to be able to test hardware 00:02:49.720 --> 00:02:52.300 devices, such as the card reading terminals, 00:02:52.300 --> 00:02:55.160 the POIs, and hardware security modules, 00:02:55.160 --> 00:03:01.740 the HSMs, that they meet the PCI‑specific security standard. And as well 00:03:01.740 --> 00:03:07.210 as accrediting assessors and laboratories, the PCI SSC also run programs 00:03:07.210 --> 00:03:12.010 that allow companies that have had their software or hardware or solutions 00:03:12.020 --> 00:03:17.650 assessed to the relevant PC standard to be listed on the PCI SSC website. 00:03:18.440 --> 00:03:21.880 This means that the PCI SSC would have reviewed the report produced by the 00:03:21.880 --> 00:03:25.360 assessor or the lab, and make sure that the assessment was done properly. 00:03:26.340 --> 00:03:33.750 The PCI SSC lists payment applications, and P2PE, SPoC, and CPoC solutions. 00:03:34.340 --> 00:03:38.170 It also lists hardware devices that have been assessed to PCI standards, 00:03:38.180 --> 00:03:42.820 so card reading and PIN accepting terminals to the PCI PTS POI 00:03:42.820 --> 00:03:48.070 standard, and Hardware Security Modules. Just in case there was any 00:03:48.070 --> 00:03:54.000 doubt, and I can't emphasize this enough, the PCI SSC does not make 00:03:54.010 --> 00:03:57.560 anyone comply with any of the PCI standards. 00:03:59.640 --> 00:04:01.890 If we need to comply with any of the standards, 00:04:02.000 --> 00:04:04.360 there's a fair chance that we're going to need one of the 00:04:04.360 --> 00:04:09.220 professionals accredited by the PCI SSC to help. You see, for every 00:04:09.220 --> 00:04:12.750 standard we have learned about, there is typically an assessor that 00:04:12.750 --> 00:04:17.130 has been qualified to assess against the standard, or in some cases, a 00:04:17.130 --> 00:04:20.100 laboratory. And as you can see, 00:04:20.250 --> 00:04:23.890 there are quite a few types to choose from, but unlike many accreditation or 00:04:23.890 --> 00:04:28.940 certification programs you may have come across before, the PCI SSC manages 00:04:28.940 --> 00:04:33.380 things a bit differently, in that both the assessor and the company an 00:04:33.380 --> 00:04:36.050 assessor works for needs to be authorized. 00:04:36.940 --> 00:04:39.460 So a company will say to the PCI SSC, 00:04:39.840 --> 00:04:41.850 we'd like to be authorized to assess things. 00:04:42.440 --> 00:04:45.660 The PCI SSC will ask the company to sign a contract, 00:04:45.670 --> 00:04:50.720 take out some insurance, and pay the PCI SSC an annual fee to be a member 00:04:50.720 --> 00:04:54.020 of the program. And then once the company is approved, 00:04:54.110 --> 00:04:57.720 it can then go out and hire individual assessors who have 00:04:57.720 --> 00:04:59.960 to sign the PCI SSC code of conduct, 00:05:00.340 --> 00:05:04.540 have their company pay a fee, and then take some training and pass the relevant 00:05:04.550 --> 00:05:07.960 assessing exam for the standard that they want to assess. 00:05:08.440 --> 00:05:12.200 So now the company is authorized, and so are their assessors. 00:05:12.200 --> 00:05:15.480 As well as assessors and assessor companies, 00:05:15.680 --> 00:05:18.990 there are two other types of companies that the PCI SSC 00:05:19.170 --> 00:05:21.450 authorizes for particular functions. 00:05:22.240 --> 00:05:25.310 Some of the standards that apply to products are assessed by 00:05:25.310 --> 00:05:28.640 accredited laboratories, who can evaluate against the more 00:05:28.690 --> 00:05:31.060 technical and hardware‑based standards. 00:05:31.940 --> 00:05:33.530 And then there are three programs, 00:05:33.680 --> 00:05:38.200 the companies that offer specific services to the payment ecosystem where 00:05:38.200 --> 00:05:41.150 both the personnel and the company have to be authorized. 00:05:41.840 --> 00:05:46.200 PCI Forensic Investigators, or PFIs, are used after a data 00:05:46.200 --> 00:05:48.730 breach to find out what happened, and also to make sure 00:05:48.730 --> 00:05:50.150 that the breach has been sealed. 00:05:50.640 --> 00:05:55.960 Approved Scanning Vendors, or ASVs, are authorized to conduct external 00:05:55.960 --> 00:05:59.550 vulnerability scans according to the PCI program for these. 00:06:00.040 --> 00:06:03.640 Because having an external vulnerability scan is actually one of the key 00:06:03.640 --> 00:06:08.490 requirements of PCI DSS, and also a separate requirement of some card 00:06:08.490 --> 00:06:12.260 schemes. And Qualified Integrators and Resellers, 00:06:12.270 --> 00:06:15.710 or QIRs, are trained in the installation of point‑of‑sale 00:06:15.710 --> 00:06:18.160 systems that handle cardholder data.