PCI DSS

Question 1

PCI DSS

Answer 1

• Payment Card Industry Security Standard
• Around since 2006
• Aims to protect cardholder information

“It’s a set of technical and operational requirements intended to protect account data, combat fraud and reduce the chances of a data breach”

• Developed by the PCI Standards Security Council (PCI SSC)

“Applies to all organizations who store, process or transmit cardholder information”

Question 2

Acquirer Responsibility

Answer 2

Acquirers are responsible for ensuring the PCI compliance of their merchant portfolios

Question 3

Requirements

Answer 3

The PCI DSS has 12 requirements classified into six goals, which cover all aspects of card data security

Question 4

Compliance Validation

Answer 4

May be done either through self-assessment, or by engaging with an accredited third party

• Quality Security Assessor (QSA)
• Internal Security Assessor (ISA)

When compliance validation is performed by a QSA or ISA, a Report on Compliance (ROC) is produced

• An additional validation require- ment applies to e-commerce merchants where they must also complete (where applicable) a quarterly network vulnerability scan performed by an Accredited Scanning Vendor (ASV)

Question 5

SAQ

Answer 5

“When compliance validation is performed through self-assessment, a Self-Assessment Questionnaire (SAQ) must be completed”

• Several options, depending on the type and size of the merchant

Question 6

Visa Merchant Level 1

Answer 6

• Annual ROC by QSA
• Quarterly network scan by Approved Scan Vendor

Question 7

Storage

Answer 7

Sensitive authentication data (which includes the card verification values) must not be stored post-authorisation

• When it coms to the CVV2, we have seen far too many data breaches at e-commerce merchants where criminals were able to get hold of this piece of data, which is intended for the eyes of the cardholder only

Question 8

Adyen’s Role in PCI DSS Compliance

Answer 8

“Adyen offers integrations that handle most of the PCI DSS requirements”

• The simplest way for you to be PCI compliant is to use our encrypted solutions—you never see and never have access to unencrypted cardholder data
• However, because you accept credit card payments on your website, your app, or in your physical store, your integration with Adyen does not completely eliminate your PCI scope

Adyen Responsibility
- Adyen is solely responsible for the security of cardholder data
- After Adyen receives your shoppers’ cardholder data, the data is contained in a PCI DSS Level 1 Service Provider Cardholder Data Environment

Merchant Responsibility
- You are responsible for making sure that cardholder data is secure and protected before the data reaches Adyen

Question 9

One actor is allowed to store sensitive authentication data post authorisation…

Answer 9

and that is the issuer.

• It is logical, after all, because they are the ASPSP and responsible for managing the card account. As such, they need all of the card account data, but they are subject to ad- ditional PCI DSS requirements