WEBVTT 00:00:00.940 --> 00:00:01.930 In the previous module, 00:00:01.930 --> 00:00:05.040 we worked out which of the PCI standards Wired Brain 00:00:05.040 --> 00:00:06.360 Coffee would have to comply with. 00:00:06.840 --> 00:00:10.230 So let's see who they'd be able to get to help them. 00:00:10.230 --> 00:00:13.630 As an organization that stores or processes or transmits 00:00:13.630 --> 00:00:15.260 cardholder data in its coffee shops, 00:00:15.640 --> 00:00:18.890 Wired Brain Coffee will be asked by its acquirer to 00:00:18.890 --> 00:00:21.160 demonstrate compliance with PCI DSS. 00:00:21.640 --> 00:00:26.090 It would need to give its acquirer a report on compliance produced either by a 00:00:26.090 --> 00:00:30.140 Qualified Security Assessor or an Internal Security Assessor, 00:00:30.140 --> 00:00:33.050 and the report on compliance, which is also known as a RoC, 00:00:33.050 --> 00:00:37.640 would state whether Wired Brain Coffee was compliant with PCI DSS. 00:00:37.640 --> 00:00:38.880 Similarly, 00:00:39.120 --> 00:00:41.450 Wired Brain Coffee would need to demonstrate compliance with 00:00:41.450 --> 00:00:44.590 PCI DSS for its e‑commerce activities and, 00:00:44.590 --> 00:00:47.960 again, would require a QSA or an ISA. 00:00:49.240 --> 00:00:52.160 It could be that Wired Brain Coffee is using validated payment 00:00:52.160 --> 00:00:54.940 software in its stores or in its payment system. 00:00:54.970 --> 00:00:59.260 So you might think a Secure Software Assessor's what's required. 00:00:59.410 --> 00:01:04.810 But remember that the PCI SSC lists validated payment software, 00:01:04.840 --> 00:01:07.930 so the application will have already been assessed by a Secure 00:01:07.930 --> 00:01:11.260 Software Assessor working for the application vendor. 00:01:12.440 --> 00:01:16.800 Wired Brain Coffee may have used a QIR, a Qualified Integration Reseller, 00:01:16.800 --> 00:01:19.030 to install the application correctly, 00:01:19.030 --> 00:01:25.200 and this we validated by the QSA or ISA as part of their PCI DSS assessment. 00:01:25.200 --> 00:01:27.020 In the coffee shops, 00:01:27.180 --> 00:01:30.990 Wired Brain Coffee has installed chip and PIN card reading devices, 00:01:30.990 --> 00:01:34.750 and Wired Brain's acquiring bank insists that these 00:01:34.750 --> 00:01:38.360 would have been validated to PCI, PTS, POI. 00:01:38.740 --> 00:01:40.360 So which assessor do we need for that? 00:01:41.040 --> 00:01:45.060 Actually, this is a bit of a trick question, but it's one that people often ask. 00:01:45.060 --> 00:01:48.550 The terminal or the card reading device will have 00:01:48.560 --> 00:01:51.730 originally been assessed by a PTS laboratory, 00:01:51.730 --> 00:01:55.660 and so it's already listed on the PCI SSC website. 00:01:55.660 --> 00:02:00.300 But the use of the PTS‑listed device is one of those things that's 00:02:00.300 --> 00:02:03.300 required by card schemes in their acquiring contracts. 00:02:03.310 --> 00:02:05.920 It's not a requirement of PCI DSS. 00:02:06.080 --> 00:02:08.650 And so it's not something that QSA needs to look at. 00:02:09.039 --> 00:02:12.040 I've mentioned it here because there's often a lot of confusion about this, 00:02:12.040 --> 00:02:14.680 and sometimes QSAs try to enforce this. 00:02:14.820 --> 00:02:18.250 This is the job of the acquirer to enforce this on their merchants. 00:02:18.840 --> 00:02:19.390 So, typically, 00:02:19.390 --> 00:02:22.620 the acquirer checks this when a merchant first wants to 00:02:22.620 --> 00:02:24.360 connect their terminal to the acquirer. 00:02:25.240 --> 00:02:27.580 Finally, moving away from Wired Brain Coffee, 00:02:27.580 --> 00:02:31.500 we also discovered how PINs move from merchants to issuers, 00:02:31.570 --> 00:02:33.960 so the issue could validate that the PIN is correct. 00:02:34.640 --> 00:02:38.410 Card schemes will require acquirers to validate their 00:02:38.410 --> 00:02:40.080 compliance with the PIN standards, 00:02:40.080 --> 00:02:43.760 and this compliance will be assessed by a Qualified PIN Assessor, 00:02:43.760 --> 00:02:44.960 or QPA. 00:02:45.540 --> 00:02:47.080 And, finally, Card Production. 00:02:47.080 --> 00:02:50.720 A Card Production Security Assessor will validate that 00:02:50.730 --> 00:02:54.110 organizations comply with the physical and logical security 00:02:54.110 --> 00:02:57.350 requirements of the PCI Card Production standards. 00:02:57.940 --> 00:03:00.250 Now let's round up quickly what we've discovered. 00:03:00.640 --> 00:03:01.630 Most importantly, 00:03:01.660 --> 00:03:06.250 remember that the PCI SSC writes and maintains the security standards, 00:03:06.460 --> 00:03:09.770 but it is the card brands or card schemes that say who 00:03:09.770 --> 00:03:12.230 has to comply with each standard. 00:03:12.230 --> 00:03:16.070 Whenever I am asked to help an organization with PCI DSS compliance, 00:03:16.070 --> 00:03:20.160 my first question is, Who's asking you to be compliant and why? 00:03:20.640 --> 00:03:22.380 Remember, it's not the law. 00:03:22.440 --> 00:03:25.260 It's usually a contractual requirement between a merchant 00:03:25.350 --> 00:03:28.160 and a card scheme or a merchant and an acquirer or a 00:03:28.160 --> 00:03:29.900 service provider and the merchant. 00:03:29.900 --> 00:03:34.230 For each PCI SSC standard, there's an assessment process. 00:03:34.230 --> 00:03:37.400 Where the standard relates to a product or solution, 00:03:37.510 --> 00:03:40.700 either an assessor or a qualified laboratory that has been 00:03:40.700 --> 00:03:42.440 specifically trained in the standard, 00:03:42.440 --> 00:03:45.360 they can undertake an assessment of the product or solution. 00:03:46.040 --> 00:03:48.660 Products or solutions that pass the assessment can 00:03:48.660 --> 00:03:50.750 be listed on the PCI SSC website. 00:03:50.750 --> 00:03:55.260 So prospective purchases of the product or the solution can determine 00:03:55.340 --> 00:03:58.360 which ones have been validated to the respective standard. 00:03:58.840 --> 00:04:02.520 Standards that apply to products or solutions include the Secure 00:04:02.520 --> 00:04:04.570 Software Standard for payment applications, 00:04:04.840 --> 00:04:08.440 PTS POI and PTS HSM for payment hardware, 00:04:08.440 --> 00:04:12.660 and P2PE, SPoC, and CPoC for payment solutions. 00:04:13.040 --> 00:04:17.000 Some card brands or schemes say that merchants that accept their 00:04:17.000 --> 00:04:21.510 cards must use PCI SSC‑listed products or solutions. 00:04:21.510 --> 00:04:26.470 Where the standard applies to how an organization secures payment card data, 00:04:26.470 --> 00:04:31.850 again, the PCI SSC trains and qualifies assessors for each standard. 00:04:32.340 --> 00:04:35.370 The organization who wants to be assessed against the standard 00:04:35.580 --> 00:04:38.240 engages the relevant Qualified Security Assessor, 00:04:38.250 --> 00:04:42.780 who, at the end of the assessment, gives their report to the organization. 00:04:42.970 --> 00:04:46.180 The organization can then pass this report on to anyone that 00:04:46.180 --> 00:04:48.590 has required it to comply with the standard. 00:04:48.590 --> 00:04:52.110 Standards that apply to how organizations secure payment card 00:04:52.110 --> 00:04:54.430 data include the Data Security Standard, 00:04:54.430 --> 00:04:58.460 PCI DSS, PCI PIN, the 3DS core standards, 00:04:58.840 --> 00:05:02.870 Card Production, and the Token Service Provider security standard. 00:05:02.870 --> 00:05:07.750 And card brands or card schemes often specify that organizations 00:05:07.750 --> 00:05:10.260 must be assessed annually against these standards. 00:05:11.340 --> 00:05:15.860 Finally, there's one other PCI qualification that we haven't looked at yet, 00:05:16.240 --> 00:05:19.750 the PCI Professional, or PCIP. 00:05:20.140 --> 00:05:23.570 This qualification is open to anyone working in the payment industry. 00:05:23.750 --> 00:05:25.740 It's not tied to a role or a company, 00:05:25.740 --> 00:05:29.000 and it isn't about an assessment or related to a standard. 00:05:29.260 --> 00:05:31.880 It shows that you've got a good general awareness for 00:05:31.880 --> 00:05:35.870 payments for the PCI standards, and PCI DSS in particular, 00:05:35.870 --> 00:05:38.380 and good general security concepts. 00:05:38.640 --> 00:05:39.850 And if this could be you, 00:05:39.940 --> 00:05:43.960 the next module looks at the PCI Professional Qualification in greater detail.