Identify compliance deficiencies and provide recommendations to achieve and verify compliance based on the 12 PCI DSS requirements and security assessment procedures in order to avoid broad regulatory actions.

1. Best Practices
for PCI
Compliance
Presented by Stuart Hylton

2. Agenda
Presentation Objective
PCI in a Nutshell
Compliance Trends
Compliance Challenges
Best Practices to Achieve Compliance

3. Key Terms
PCI – Payment Card
Industry
SSC – Security
Standards Council
DSS – Data Security
Standard
QSA – Qualified
Security Assessor
QIR – Qualified
Integrators &
Resellers
SAQ – Self
Assessment
Questionnaire
FAQ – Frequently
Asked Questions
DPCP – Data Protection
Compliance Program

4. Presentation
Objective
To provide insights into the PCI
compliance process and lessons
learnt that will enable companies
to better prepare themselves for
the PCI compliance audit.

5. PCI in a Nutshell: PCI SSC • Source: https://www.pcisecuritystandards.org/pci_security/

6. PCI in a Nutshell: PCI DSS

7. PCI in a Nutshell: PCI DSS Levels
• 6M+ Transactions/YearLevel 1
• 1 – 6M Transactions/YearLevel 2
• 20K – 1M Transactions/YearLevel 3
• < 20K Transactions/YearLevel 4

8. Source: https://www.pcisecuritystandards.org/pci_security/standards_overview

10. Compliance
Trends
Source: Verizon Payment
Security Report (2019)

11. Compliance
Trends
Source: Verizon Payment
Security Report (2019)

12. Compliance
Trends (cont’d)
Source: Verizon Payment Security Report (2019)

13. Compliance Challenges
Focus on meeting
compliance vs
maturing DPCP
Lack of adequate
resources
Inaccurate scope

14. Potential
Liabilities
Lost confidence, so customers go elsewhere
Diminished sales
Cost of reissuing new payment cards
Fraud losses
Higher subsequent costs of compliance
Legal costs, settlements and judgments
Fines and penalties
Termination of ability to accept payment cards
Lost jobs (CISO, CIO, CEO and dependent professional positions)
Going out of business

15. Best Practices
Adequately
scope card data
environment
(CDE)
01
Perform gap
assessment
02
Implement
adequate tools/
systems/
Controls
03
Operationalize
Requirements
04
Identify/ Assign
an internal
compliance
officer
05

16. Best
Practices:
Adequately
Scope CDE
DETERMINE WHAT CARD
DATA IS NEEDED
IDENTIFY WHERE CARD DATA
IS STORED
IDENTIFY WHAT CARD DATA
YOU HAVE
IDENTIFY POTENTIAL PLACES
CARD DATA MAY EXIT

17. Card Data

18. Best Practices:
Perform Gap Assessment
PERFORM A READINESS
CHECK
CONSIDER THIRD PARTY
ASSESSMENTS

19. Best Practices:
Implement adequate tools/systems/controls
CARD READERS POINT OF SALE
SYSTEMS
PAYMENT CARD DATA
STORAGE AND
TRANSMISSION
PAYMENT CARD DATA
STORED IN PAPER-
BASED RECORDS
ONLINE PAYMENT
APPLICATIONS AND
SHOPPING CARTS

20. Best Practices:
Operationalize Requirements
IMPLEMENT A FORMAL DATA
PROTECTION COMPLIANCE PROGRAM
REGULARLY MEASURE AND ASSESS
COMPLIANCE
MAKE IMPROVEMENT A GOAL

21. Best Practices:
Identify an Internal Compliance Officer
HIRE AN EXPERIENCED
COMPLIANCE OFFICER
IDENTIFY SUITABLE
INTERNAL EMPLOYEE
CONSULT THIRD PARTIES

22. Resources
Payment Card Industry Security
Standards Council
Verizon: Payment Security
Report 2019

23. Questions

24. Connect With Us
info@symptai.com
www.symptai.com
876-968-6189