How PCI DSS assessments run: the QSA audit and ROC, the Attestation of Compliance, compensating controls, the customized approach, the Prioritized Approach, internal assessors and handling end-of-life systems.
How a QSA-led PCI DSS assessment works: who sets the validation requirements, scoping and sampling, onsite versus remote assessment, evidence from other audits, the ROC template, the date of report and when the AOC can be signed.
What the AOC declares, who signs it for SAQs and ROCs, why it cannot precede the ROC, sharing it with customers and what may be redacted, service provider AOCs as customer evidence, and why certificates are not a substitute.
When a compensating control can stand in for a PCI DSS requirement: legitimate constraints, the worksheet, who judges sufficiency, why missed periodic activities cannot be compensated, unsupported systems and call recording examples.
How the customized approach differs from meeting requirements as written: who it is meant for, the targeted risk analysis each customized requirement needs, why SAQs cannot document it, ROC validation and how it relates to compensating controls.
Using the Prioritized Approach to plan remediation: the six milestones and their order, whether acquirers accept it in place of a ROC or AOC, partial assessments of selected milestones, and reporting untested requirements.
When it pays to have an employee qualified as a PCI Internal Security Assessor: sponsorship and experience, training and exam, annual requalification and fees, the ISA's role on SAQs, and how ISAs relate to QSAs and independence rules.
What PCI DSS expects when an operating system or product reaches end of life: the annual technology review, patching expectations, compensating controls as a temporary measure, ASV automatic failures and the migration plan assessors look for.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.