The PCI Council manages security standards, while card companies enforce alignment with PCI Security Standards. The requirements concern all organisations that store, process or transmit credit card data, as well as software developers and manufacturers of applications and devices used in such transactions.
If you are a merchant accepting credit cards, you must comply with the PCI Data Security Standard. Arrange an appointment with our specialist consultant to learn your exact compliance requirements. The standard's creators divide those subject to certification into three categories, which determine the final requirements and the process.
How much does PCI DSS certification cost?
To find your business's certification type and its cost, simply use the online certification type selection tool.
ENVIRONMENT IDENTIFICATION
The most important PCI step is understanding and defining the in-scope environment and minimising it (scope minification). This stage is crucial because it determines the necessary requirements. Failure to complete it correctly may render your certification invalid.
GAP ASSESSMENT
This process checks compliance with every PCI DSS requirement applicable to your business. It also checks the completeness and accuracy of the organisation's security policies. The gap assessment determines the actions needed for full compliance with the PCI standard.
ON-SITE Audit
Merchants performing more than 6,000,000 credit card transactions per year and service providers performing more than 300,000 transactions must undergo an annual on-site audit by Qualified Security Assessors (QSAs) to validate compliance. This step is also required for Payment Service Providers and businesses that have suffered data theft, regardless of transaction volume.
ASV Scans
Perhaps the best-known stage of the process, partly because many businesses are incorrectly guided, mainly by IT partners such as developers and system administrators, to believe this stage alone constitutes compliance. Authorised Scanning Vendors perform external scans of the organisation's infrastructure perimeter to identify technical security vulnerabilities.
PCI DSS Certification
Once all the above steps have been completed successfully, Innotech will issue the necessary AOC (Attestation of Compliance) or ROC (Report of Compliance), depending on your certification level.
Let’s look at it together
Discuss your business needs with our team.
Talk to a PCI expertFind your certification type