PCI DSS Assessment: What You Need To Know

‍What does it take to meet PCI DSS standards? To answer this, you need to assess your organization’s security policies and procedures. Therefore, the first step is to conduct a proper PCI DSS assessment for your organization. This article provides an in-depth examination of PCI DSS assessments.

With the increasing number of cyber threats also come the risks of data breaches and non-compliance with regulations. These can result in stolen data (such as payment card information), substantial fines, and damage to an organization’s reputation.

The goal of the PCI DSS is to help your organization better protect cardholder data. One potential challenge is making sure your organization is PCI DSS compliant. As an IT manager, you will face a daunting task in locating and resolving these compliance problems.

This is why the PCI DSS assessment is necessary. Every organization handling cardholder data needs to determine its compliance requirements. But is it the same for all types of organizations? The answer is No. If your organization is mid to large-sized, a more detailed PCI DSS assessment is required. This involves an on-site assessment by a Qualified Security Assessor (QSA).

On the other hand, if your organization is small to medium-sized, you need to follow a simpler version of the standards, known as the Self-Assessment Questionnaire (SAQ). To meet these requirements, you need to conduct an internal assessment.

Note: The SAQ involves evaluating and documenting internal compliance without the assistance of a QSA.

Let’s learn about both types of PCI DSS assessments in detail.

Two Types of PCI DSS Assessments

The type of PCI DSS assessment that your organization needs depends on which PCI DSS level it falls under. Moreover, the PCI DSS levels are based on your transaction volume and the potential risks your organization might face.

1. On-site Assessment

An on-site assessment is required if your organization falls under PCI DSS Level 1. This level applies to organizations that process over 6 million card transactions annually or are prone to high risk due to data breaches. These organizations might include global e-commerce companies, large retail chains, or payment processors, provided they are eligible.

While conducting this type of PCI DSS assessment, a Qualified Security Assessor (QSA) (who is an external auditor) is involved. They will perform a detailed review of your organization’s systems, processes, and policies (if your organization falls under the category mentioned above).

Note: The primary goal of this assessment is to comply with the 12 PCI DSS requirements.

Once this assessment is completed, the QSA will provide your organization with an Attestation of Compliance (AoC) and a Report on Compliance (RoC). This will serve as a certification that your organization meets the required standard.

Cost of On-site assessment: The cost of this assessment ranges from $20,000 to $100,000 or more. However, this cost depends on the complexity of your IT infrastructure and the scope of the review. However, the RoC is a mandatory document if your organization comes under Level 1 and serves as proof of compliance.

2. Internal Assessment

This type of PCI DSS assessment is designed for organizations that fall under PCI DSS Levels 2, 3, and 4. These levels primarily encompass organizations with fewer transactions (less than 6 million annually).

For this assessment, you do not need to hire a QSA. An internal team within your organization can conduct this, guided by a self-assessment questionnaire (SAQ).

Note: The PCI SAQ is a subset of PCI DSS requirements, helping you assess your organization's security posture.

Cost of Internal Assessment: It is lower compared to an on-site assessment, as your organization manages the process internally with its team. However, if your organization requires some external help, then the consulting fees can be $1,000 to $10,000 (depending upon the level of assistance needed).

Imagine that you have determined your organization needs to perform an internal assessment, guided by the volume of transactions and PCI SAQs. However, there are 8 different types of SAQs. Now, it's essential to understand which SAQ type will best suit your organization. Let’s find out in detail.

Types of PCI DSS Self-Assessment Questionnaire (SAQs)

Here is the list of all the types of SAQ that will help you choose the one that is suitable for your organization.

1. SAQ A

Conducting a PCI DSS assessment for this type of SAQ is for organizations that handle payments but have minimal interaction with sensitive payment card data. This means your organization will qualify for this if it processes payments through third-party service providers.

Who qualifies for SAQ A?

All cardholder data is handled exclusively by trusted third-party vendors, such as payment gateways.
Your website does not collect or store payment details directly from customers.
Maintain limited responsibility for securing payment systems.

For example, an organization that uses a payment gateway to handle transactions qualifies. This makes SAQ A an ideal choice for your organization if it has outsourced payment processing.

In addition, to qualify for SAQ, your organization is required to confirm that:

Cardholder data is not stored on their systems.
Their third-party vendors meet PCI DSS compliance requirements.
Any redirection or frame used for payment is secure.

2. SAQ A -EP

For SAQA-EPP, you can conduct a PCI DSS compliance assessment if your organization is involved in online payment processing. It applies to organizations that will outsource their payment transactions but still have some technical responsibilities.

SAQ A-EP is for merchants who rely on third-party payment processors but manage their websites. These websites facilitate the initial connection, redirecting individuals to the payment provider. This will ensure that your organization secures the environment to protect payment data during the redirection process.

Eligibility criteria for SAQ A-EP include:

Using third-party services for payment processing.
Maintaining a website that directly interacts with cardholder data redirection.
Ensuring the website is hosted securely to prevent tampering.

Key requirements of this PCI DSS assessment involve:

Implementing robust security measures for the website, including firewalls and encryption.
Regularly testing for vulnerabilities and ensuring secure configurations.
Ensuring third-party service providers meet PCI DSS standards.
Monitoring for and preventing unauthorized access to web systems.

3. SAQ B

SAQ B, a PCI DSS assessment, is for those organizations that process card payments using standalone payment terminals. These terminals must not connect to the internet or store cardholder data electronically. Thus, conducting a PCI DSS assessment will help ensure that basic security requirements are met without requiring many complex compliance measures.

The eligibility criteria for SAQ B are:

Using standalone terminals connected through phone lines or similar methods.
Avoiding any storage of cardholder data in digital systems.
Ensuring that no electronic payment systems connect to the internet.

Moreover, this PCI DSS assessment helps organizations to verify:

Physical security of payment terminals to prevent tampering.
Secure communication channels, such as phone lines, for transactions.
Regular inspection of payment devices for signs of compromise.
Policies and procedures to handle cardholder data securely.

4. SAQ B -IP

You can perform a PCI DSS assessment for SAQ B - IP (SAQ B - Internet Protocol) if your organization uses payment terminals connected to the internet. These terminals process transactions securely through a PCI DSS-compliant service provider. Thus, performing SAQ B-IP will help to ensure that you take preventive steps to secure your organization’s environment.

Now, let’s see the eligibility criteria for conducting a PCI DSS assessment for SAQ B-IP.

Using payment terminals that have IP connections for the card transactions.
Relying on PCI DSS-compliant service providers for processing.
Ensuring the terminals do not store sensitive cardholder data.

Also, this PCI DSS assessment focuses on:

Protecting terminals against unauthorized access
Ensuring secure communication of payment data using encryption
Verifying that the service provider handling transactions is compliant
Maintaining physical and logical security for payment devices

5. SAQ C

For SAQ C, perform a PCI DSS assessment if your organization processes payments through connected systems while maintaining limited access to sensitive data. These systems handle transactions but do not store sensitive card data.

For conducting a PCI DSS assessment for SAQ C, the eligibility criteria include:

Using internet-connected payment systems for processing cardholder data.
Not storing cardholder data electronically after transactions.
Securing their payment systems and networks to prevent breaches.

By performing this PCI DSS security assessment, you can ensure that your organization secures the network and payment environment to meet PCI DSS requirements.

Also, this PCI DSS self-assessment questionnaire focuses on:

Encrypting cardholder data during transmission to prevent unauthorized access.
Regularly testing payment systems and network security.
Using strong firewalls and access controls to protect the environment.
Ensuring third-party payment processors comply with PCI DSS standards.

Now, suppose your organization operates in multiple locations. Each location uses a payment system connected to the internet to process payments. These systems send cardholder data to a secure payment processor without storing it locally.

Your team ensures the payment systems are up-to-date, encrypted, and isolated from other networks. They also conduct vulnerability scans and verify the compliance of the payment processor. These steps help your organization meet SAQ C requirements.

6. SAQ C -VT

You need to perform a PCI DSS assessment for SAQ C-VT (Self-Assessment Questionnaire C – Virtual Terminal) if your organization processes cardholder data using a virtual terminal. A virtual terminal is a web-based interface provided by a third-party payment processor.

This type of SAQ ensures that your organization secures its systems when handling card payments. Here are the eligibility criteria for SAQ C - VT.

Using a virtual terminal provided by a PCI DSS-compliant service provider.
Processing payments through a computer or device solely used for this purpose.
Ensuring that no sensitive cardholder data is stored in digital form.

Moreover, SAQ C-VT focuses on:

Use secure connections, such as HTTPS, to access the virtual terminal.
Limiting access to devices used exclusively for processing payments.
Ensure the computer or device is protected with antivirus software and firewalls.
Restricting physical and network access to the device to prevent tampering or unauthorized use.

Imagine your organization has a subscription for a SaaS app and processes the subscription payment through a single, dedicated system. Your team uses this system to access a virtual terminal provided by a PCI DSS-compliant payment processor.

This system has antivirus software installed and is restricted from accessing other networks or applications. Your team regularly updates the system and ensures secure access to the terminal. These steps align with SAQ C-VT requirements.

7. SAQ P2PE -HW

You can conduct a PCI DSS assessment for SAQ Point-to-Point Encryption Hardware (SAQ P2PE -HW) if your organization uses validated point-to-point encryption (P2PE) solutions. This will ensure that your organization meets PCI DSS requirements with simplified compliance steps.

Eligibility for conducting PCI DSS assessment for SAQ P2PE requires:

Using only P2PE-approved devices for payment processing.
Not storing cardholder data electronically within your organization.
Relying on the P2PE solution provider to manage encryption and key handling.

SAQ P2PE -HW focuses on:

Ensuring that all payment devices are part of a validated Point-to-Point Encryption (P2PE) solution.
Maintaining the physical security of the devices to prevent tampering.
Follow documented procedures provided by the P2PE vendor.
Conducting regular inspections to ensure the devices remain secure.

Overall, SAQ P2PE-HW simplifies PCI DSS compliance for your organization if it uses secure, validated payment devices.

8. SAQ D

To meet SAQ D, you need to conduct a PCI DSS assessment if your organization processes, stores, or transmits cardholder data in complex environments. This will ensure that these organizations meet all the applicable requirements.

The eligibility criteria for performing a PCI DSS assessment for SAQ D are:

Storing, processing, or transmitting cardholder data electronically.
Using complex IT systems, such as multi-point integrations or in-house payment solutions.
Handling scenarios not covered by simpler SAQ types, like P2PE or virtual terminals.

Key areas that SAQ D focuses on:

Securing cardholder data at rest and in transit through encryption and secure storage practices.
Implementing strong access controls and restricting access to sensitive data.
Regularly testing network security and running vulnerability scans.
Monitoring and logging access to cardholder data systems.
Ensuring third-party service providers meet PCI DSS requirements.

By following this PCI DSS assessment, your organization can protect sensitive data, reduce risks, and build customer trust.

Steps to Perform the PCI DSS Self-Assessment Questionnaire

Below are the steps to complete the PCI DSS assessment process.

Step 1: Determine your PCI DSS Level

The first step is to understand and identify your PCI DSS level. This will depend on the volume of card transactions your organization processes annually. Thus, knowing your level will guide you in determining which PCI DSS assessment you need to complete.

Step 2: Complete the self-assessment questionnaire

Choose the correct SAQ based on your PCI DSS level and complete it thoroughly. This questionnaire helps assess your security measures against PCI DSS requirements.

Note: Ensure that you answer all questions correctly during the PCI DSS assessment.

Step 3: Gather your supporting documentation

Collect all relevant documentation to support your SAQ answers. This may include your company’s security policies, network diagrams, access control logs, and any evidence of security practices (like firewalls or encryption).

Step 4: Submit your SAQ and documentation

Once the SAQ is completed and all supporting documents are gathered, submit the entire package to your acquiring bank or payment card brand. Some banks or brands may have specific submission instructions, so it’s essential to confirm the process with them.

Step 5: Await confirmation of compliance

After submission, the acquiring bank or payment card brand will review your materials. If your SAQ and documentation meet the requirements, you will receive confirmation of PCI DSS compliance.

Step 6: Address non-compliance issue (if any)

If your SAQ is found to have gaps or non-compliance, you will be required to provide additional clarification or make necessary changes. Thus, work with your security team to resolve any issues efficiently.

Step 7: Maintain your ongoing compliance

You must continuously monitor and maintain your security measures to stay compliant. To achieve this, you need to regularly review your security protocols and perform periodic scans and assessments.

Simplify your PCI DSS Assessment Process

Regardless of whether your organization qualifies for SAQ A or SAQ D, compliance with PCI DSS is mandatory. It requires meeting strict security standards to protect cardholder data, including implementing security controls, encrypting account data, and controlling access to sensitive data. But how do you simplify this?

For instance, if you want to implement access control, you need to review your users’ access and remediate the unnecessary access. To streamline this process, you can leverage tools like Zluri. Zluri offers an access review solution that allows you to create access certifications for reviewing access.

The platform gives you clear visibility into who can access your systems and data. This ensures that only authorized individuals have access, helping your organization meet PCI DSS requirements.

But how can you prove your PCI compliance? Zluri simplifies this by providing an access review report. This report includes key details such as users, their roles in applications, review status, remediation actions, and more. These insights enable auditors to more effectively evaluate user access, demonstrating your commitment to compliance with PCI DSS.

Now, let’s take Intune as an example to see how you can automate access review in Zluri.

Also Read: If you want to meet the PCI DSS requirements, you can go through 12 PCI DSS Compliance Checklists.

Frequently Asked Questions (FAQs)

1. What is a PCI SAQ?

A PCI Self-Assessment Questionnaire (SAQ) is a subset of the PCI DSS compliance standard that requires an internal team to conduct the assessment. A merchant or service provider can only qualify for SAQ if it falls under PCI DSS Level 2, 3, or 4.

2. What is SAQ D for service providers?

SAQ D applies to service providers who handle cardholder data for merchants. This includes hosting, payment processing, and data storage. These providers must demonstrate that they follow PCI DSS by maintaining the security of stored data, protecting networks, and controlling access.

3. How frequently do you need to complete the PCI SAQ?

Payment brands determine how frequently businesses must complete PCI SAQs. For Level 2-4 organizations, this happens once a year.

4. What is an electronic cardholder?

An electronic cardholder owns a digital version of a payment card, such as a credit or debit card, to facilitate electronic transactions. These cardholders keep their card details safe in digital wallets or payment systems. This allows you to a quick and safe online purchases and payments.