Book a discovery call

  • Service Providers – What is Changing in PCI DSS v4.0?

    Service Providers – What is Changing in PCI DSS v4.0?

    Service providers have always had a slightly different focus in PCI DSS because as a service
    provider you have the ability to impact your customers’ PCI DSS compliance and overall
    security. Whether that’s through providing certain managed services like managed firewalls or
    data centres, your customers expect you to be able to demonstrate that certain requirements
    are met. The easiest way to do this is by completing your own PCI DSS compliance (rather than
    being included in multiple customer assessments).

    However, the way that service providers need to report is changing with PCI DSS version 4.0.
    The report type that needs to be completed is not changing for service providers (you still need
    to complete either SAQ D – Service Providers or a Report on Compliance (ROC)).

    In this post we will focus on SAQ D for service providers, but don’t worry, we will be publishing
    more information about the RoCs and service provider requirements separately.

    New Reporting Format

    The biggest change for service providers who are using SAQ D (Service Provider) is that there
    is a much greater level of reporting needed. In PCI DSS v3.2.1 SAQ D (Service Provider)
    looked the same as the other SAQs (just with a lot more requirements). But now, the SAQ is
    much more like a mini-RoC with each requirement needing an explanation of how the finding
    was reached.

    Along with each requirement having a summary of the findings, the SAQ also now requires:

    • Network diagrams
    • Information about any storage of account data
    • Information about any storage of sensitive authentication data (SAD)
    • Information about each of the system components included in the scope
    • Results of quarterly ASV scanning

    This is all information that you would see in a full RoC.

    Unlike the RoC, SAQ D (Service Provider) does not have any ability to do custom testing – so if
    you want to do custom testing you will have to complete a RoC with a QSA.

    What Do These Changes
    Actually Mean?

    Things are changing quite a bit in version 4.0 for service providers.

    • Expect to spend more time on the process – all of the testing processes need to be
      followed and reported on, expect to have to interview people and review systems.
    • Expect to need to have someone who understands PCI DSS so that the answers provided
      make sense (PCIP, ISA, QSA)
    • Expect to have to have cross-functional participation for completing the report – not
      everyone will have the expertise to assess the questions, and you’ll have to make sure
      that the roles involved understand why they need to be involved
    • If your report is not easy to understand or is not comprehensive, there may be more
      queries from your merchants who are relying on your compliance because they may not
      understand what you have explained
    • If your report is well written, easy to understand, and comprehensive, you stand a chance
      to benefit from fewer queries because their questions have already been answered

    Overall, SAQ D for Service Providers is adding some complexity, but will benefit merchants in
    the long run who will gain a far greater understanding of how their security is being managed.

    Are You a Service Provider?

    If you’re a service provider and you need help figuring out this new reporting format or what the
    new reporting means for you, Confide can help. We’ve worked with many service providers in
    NZ to help them achieve PCI DSS compliance. Contact us to find out how we can help you
    become PCI DSS compliant against PCI DSS v4.0.

    Helena Kuwabara

    , ,

  • Rapid Requirements: Responsibility Matrix

    Rapid Requirements: Responsibility Matrix

    Supporting Your Customers

    As a service provider, your customers are always looking for more information about which
    requirements they are responsible for and which ones you’re responsible for. Some service
    providers have provided responsibility matrix documents, others have provided their AoC,
    others have provided other documents.

    But in v4.0, there’s a new requirement which sets out how third party service providers (TPSPs)
    need to support their customers’ compliance.

    • 12.9.2: TPSPs must provide either:
      • PCI DSS compliance status information for any service performed on behalf of
        customers AND
      • Information about which requirements are the responsibilities of the customer, the
        TPSP, and which are shared.

    An AoC doesn’t always give customers enough detail to be able to know how the
    responsibilities for each of the requirements split out, so the SSC suggests in their guidance
    that good practice would be to provide customers with a responsibility matrix that identifies all
    relevant PCI requirements, and indicates who is responsible for each, including which
    requirements have shared responsibility.

    Need Help Developing a
    Responsibility Matrix?

    Confide can help you document a responsibility matrix that you can provide to your customers.
    We’ve worked with many service providers and understand how responsibilities might not
    always be straight forward. Talk to us to see how we can help you.

    Helena Kuwabara