QSA Services.PCI DSS Level 1 assessment.
QSA assessment services for Level 1 merchants and service providers. Review of the payment environment, assessment against PCI DSS requirements and reporting through a Report on Compliance (ROC) and Attestation of Compliance (AOC).
QSA / PCI DSS
Your assessment journey
- 01Scope validation
- 02Requirements assessment
- 03Findings & reassessment
- 04ROC & AOC
BASED ON YOUR ENVIRONMENT
QSA services for Level 1.
The assessment examines systems, processes and security controls within PCI DSS scope. It includes evidence review, interviews and observation of implemented controls.
Scope validation
Review of cardholder data flows, the CDE, connected systems and network segmentation to validate the assessment scope.
PCI DSS requirements assessment
Review of policies, procedures, configurations and technical evidence. Interviews with responsible teams and observation of security controls in operation.
Findings and reassessment
Documentation of gaps against requirements and review of relevant evidence following corrective actions by the organisation.
Report on Compliance & AOC
Preparation of the ROC documenting assessment methods and results, and completion of the associated AOC documentation in line with the findings.
PCI DSS / LEVEL 1
Detailed assessment. Documented results.
The service is designed for Level 1 organisations requiring a PCI DSS assessment with a QSA. The Report on Compliance (ROC) documents the scope, testing methods and findings. The Attestation of Compliance (AOC) summarises the assessment outcome. Reporting requirements are confirmed with the acquiring bank or relevant payment brand.
Discuss your requirementsTHE ASSESSMENT PROCESS
Four steps with clear follow-through.
- 01
Scope validation
Review of cardholder data flows, the CDE, connected systems and network segmentation to validate the assessment scope.
- 02
PCI DSS requirements assessment
Review of policies, procedures, configurations and technical evidence. Interviews with responsible teams and observation of security controls in operation.
- 03
Findings and reassessment
Documentation of gaps against requirements and review of relevant evidence following corrective actions by the organisation.
- 04
Report on Compliance & AOC
Preparation of the ROC documenting assessment methods and results, and completion of the associated AOC documentation in line with the findings.
For Level 1 organisations.
Level 1 merchants
Assessment of the payment acceptance environment and implemented PCI DSS controls.
Level 1 service providers
Assessment of services and systems that affect cardholder data security.
Annual reassessment
A new assessment cycle reviewing scope changes, evidence and continued implementation of requirements.
Before we start.
What is a QSA?
QSA stands for Qualified Security Assessor. QSA assessors work through companies qualified under the PCI Security Standards Council’s programme to assess compliance with PCI DSS.
Who is the service for?
The service is for Level 1 merchants and service providers requiring a PCI DSS assessment with a QSA. Classification and reporting requirements are determined by the relevant payment brand and acquiring bank.
Are ROC and AOC included?
The ROC is the detailed PCI DSS assessment report. The AOC summarises the outcome and provides the associated attestation. Completion is based on assessment findings and does not guarantee a successful outcome.
Is the assessment entirely remote?
Delivery depends on the scope and required assessment methods. The QSA may need to be onsite. Practical arrangements are agreed in the engagement plan.
How do I get a quote?
Send a short description of your business, payment environment and assessment requirement. We will discuss the information needed and prepare a tailored proposal.
PCI Security Standards Council information
LET’S ORGANISE YOUR ENGAGEMENT
Start with a discussion about QSA Services.
Describe your payment environment and Level 1 assessment requirements to establish the scope, schedule and deliverables.
+30 210 600 66 66