Service providers have always had a slightly different focus in PCI DSS because as a service
provider you have the ability to impact your customers’ PCI DSS compliance and overall
security. Whether that’s through providing certain managed services like managed firewalls or
data centres, your customers expect you to be able to demonstrate that certain requirements
are met. The easiest way to do this is by completing your own PCI DSS compliance (rather than
being included in multiple customer assessments).
However, the way that service providers need to report is changing with PCI DSS version 4.0.
The report type that needs to be completed is not changing for service providers (you still need
to complete either SAQ D – Service Providers or a Report on Compliance (ROC)).
In this post we will focus on SAQ D for service providers, but don’t worry, we will be publishing
more information about the RoCs and service provider requirements separately.
New Reporting Format
The biggest change for service providers who are using SAQ D (Service Provider) is that there
is a much greater level of reporting needed. In PCI DSS v3.2.1 SAQ D (Service Provider)
looked the same as the other SAQs (just with a lot more requirements). But now, the SAQ is
much more like a mini-RoC with each requirement needing an explanation of how the finding
was reached.
Along with each requirement having a summary of the findings, the SAQ also now requires:
- Network diagrams
- Information about any storage of account data
- Information about any storage of sensitive authentication data (SAD)
- Information about each of the system components included in the scope
- Results of quarterly ASV scanning
This is all information that you would see in a full RoC.
Unlike the RoC, SAQ D (Service Provider) does not have any ability to do custom testing – so if
you want to do custom testing you will have to complete a RoC with a QSA.
What Do These Changes
Actually Mean?
Things are changing quite a bit in version 4.0 for service providers.
- Expect to spend more time on the process – all of the testing processes need to be
followed and reported on, expect to have to interview people and review systems. - Expect to need to have someone who understands PCI DSS so that the answers provided
make sense (PCIP, ISA, QSA) - Expect to have to have cross-functional participation for completing the report – not
everyone will have the expertise to assess the questions, and you’ll have to make sure
that the roles involved understand why they need to be involved - If your report is not easy to understand or is not comprehensive, there may be more
queries from your merchants who are relying on your compliance because they may not
understand what you have explained - If your report is well written, easy to understand, and comprehensive, you stand a chance
to benefit from fewer queries because their questions have already been answered
Overall, SAQ D for Service Providers is adding some complexity, but will benefit merchants in
the long run who will gain a far greater understanding of how their security is being managed.
Are You a Service Provider?
If you’re a service provider and you need help figuring out this new reporting format or what the
new reporting means for you, Confide can help. We’ve worked with many service providers in
NZ to help them achieve PCI DSS compliance. Contact us to find out how we can help you
become PCI DSS compliant against PCI DSS v4.0.
