PCI DDS Scan

What is PCI DSS?

Payment Card Industry Data Security Standard (PCI DSS) is a standard that includes technical and managerial requirements aimed at ensuring the security of credit and debit card transactions and protecting cardholders from misuse of their personal information. PCI DSS was co-created by five major credit card companies in 2004.

PCI DSS Controls Our methodology

01 PROJECT START MEETING

The project's purpose, process, necessary resources, and risks are evaluated with a project kickoff meeting attended by senior management and relevant unit managers. In consultation with the relevant units, it is ensured that the scope that will be the basis for PCI DSS compliance and auditing is determined correctly.

02 DETERMINING THE SCOPE OF PCI DSS

While determining the scope, all processes and components related to the business processes, campuses, data centers, systems, employees, service providers, transmission, operation, storage, destruction of the credit/debit card, and card information security are considered. PCI DSS scope document is prepared.

03 PCI DSS DIFFERENCE (GAP) ANALYSIS

A difference analysis service is performed to determine the compliance of the existing structure with the current PCI DSS standard.

The analysis study determines the elements that do not comply with the standard and the reasons for non-compliance.

A Difference Analysis Report is prepared as a result of the analysis service. It is performed by QSA (Qualified Security Assessor) experts authorized by PCI SSC.

04 PCI DSS IMPROVEMENT CONSULTING SERVICE

Consultancy services are provided for Credit/Debit card applications and the establishment of payment infrastructure by PCI DSS.

With Secureway and the organization, a prioritization document is created, work steps, responsibilities, and deadlines are determined to eliminate incompatibilities.

Necessary documents for compliance are prepared.

05 PCI DSS SITE AUDIT (ON-SITE AUDIT) SERVICE

On-site inspection service with QSA (Qualified Security Assessor) experts authorized by PCI SSC after eliminating all incompatibilities identified in the Difference Analysis Report

(On-Site Audit) is performed.

ROC as a result of audit service

(Report On Compliance) is prepared.

06 CERTIFICATE OF COMPLIANCE (AOC) PREPARE AND SHARE

After the ROC document is prepared and forwarded by Secureway and reviewed by the Organization, the PCI DSS Compliance Certificate - Attestation of Compliance (AOC) document is prepared. The audit process ends with the signature of the Auditor (QSA) and the Authority's officials.

If the AOC document needs to be forwarded to payment brands or banks, Secureway provides the necessary communication and sharing.

PCI SSC and Standards

It is a standard developed by the PCI council to ensure the security of payment cards. Established by VISA, Mastercard, American Express, Discover, and JCB, the commission sets security standards for payment cards and leads the payment cards industry in their announcement, training, and audits.

Standards published by the PCI council

• PCI DSS - Payment Card Industry Data Security Standard
• PA-DSS - Payment Application Data Security Standard
• P2PE - Point to Point Encryption Standard
• PTS - Pin Transaction Security
• PCI 3DS - PCI 3DSecure Core Security Standard
• PCI FAQ - Secure Software Standard

PCI DSS MERCHANT LEVELS

PCI DSS SERVICE PROVIDER LEVELS