Security Metrics

Question 1

What does PCI mean?

Answer 1

Payment Card Industry

Question 2

What does DSS mean?

Answer 2

Data Security Standard

Question 3

SSC

Answer 3

Security Standards Council

Question 4

System components that are likely in scope for your environment.

Answer 4

• Networking devices
• Servers
• Switches
• Routers
• Computing devices
• Applications

Question 5

CDE

Answer 5

Cardholder Data Environment

Question 6

SAQ

Answer 6

Self Assessment Questionnaire

Question 7

How many different SAQ Types are there and what is the overriding distinction between them?

Answer 7

Nine.

It’s determined by the methods you use to accept, process, store payments and card data.

Question 8

What are some reasons I can use for the increase in PCI fee?

Answer 8

PCI DSS 4.0

• Enhanced to meet the security needs of the payments industry
• **as technology progresses we reap benefits but this is one of the drawbacks amongst all the benefits
• Enhance validation measures and procedures
• Authentication info is now required to be encrypted (pre-authorization). Before it was merely recommended

Question 9

PAN

Answer 9

Primary Account Number

Question 10

SAQ-A

Answer 10

• Card not present only
• Entirely outsourced
• No storage on site
• All handled by PCI DSS compliant 3rd party
• Card payments are via a re-direct to 3rd-party

Question 11

SAQ A-EP

Answer 11

• Merchant only accept E-commerce transactions
• All cardholder data, except the payment page, is outsourced to 3rd party
• Your e-commerce website does not receive cardholder data but does direct them to 3rd party
• Your company does not store, process, or transmit cardholder data on your systems or premises
• Any cardholder data your company retains is on paper, and not received electronically

Question 12

SAQ B

Answer 12

• company only uses a knucklebuster or standalone dial-out terminals to take payment information
• the standalone, dial-out terminals are not connected to any other systems
• the standalone, dial-out terminals are not connected to the Internet
• CHD is stored on paper, not electronically

Question 13

SAQ B-IP

Answer 13

• Standalone IP devices
• Standalone IP devices are not connected to any other systems in your environment
• Standalone IP device does not rely on any other device to connect to payment processor
• Your company does not store cardholder data electronically
• Paper receipts, no electronic receipts

Question 14

SAQ C

Answer 14

• Your business has a payment app system and an internet connection on the same device
• The payment application isn’t connected to any other systems in your environment
• Paper only cardholder data storage and not electronic storage

Question 15

SAQ C-VT

Answer 15

• Your company only processes payments through a virtual payment terminal accessed by an internet-connected web browser
• Your company’s virtual terminal is hosted by a PCI DSS 3rd-party service provider
• Your computer is not connected to other locations or systems within your environment
• Your computer does not store cardholder data
• There is not attached hardware that captures or stores CHD
• Paper only storage and not received electronically
• Your company does not store cardholder data in electronic format

Question 16

SAQ P2PE

Answer 16

• All payments processed through a PCI P2PE solution approved and listed by the PCI SSC
• The POI (Point of Interaction) is the only device in the environment that holds electronic CHD
• No other device can hold cardholder data (paper storage okay)
• Receipts held are paper only, not electronic
• Your business has implemented all controls in P2PE Instruction Manual provided by P2PE Solution Provider

Question 17

SAQ D (Merchants - there is also a “Service Providers” version)

Answer 17

• This is for merchants who don’t meet the criteria for any other SAQ type
• For merchants who store card info electronically and don’t use a P2PE certified POS systems
• May have elements of other SAQ types but also store data

Question 18

PCI DSS 4.0

Answer 18

Upgraded from PCI DSS 3.2 to ensure standard continues to meet security needs of payment industry, promote security as a continuous process and enhance validation methods and procedures.