All organisations that store, process or transmit credit card information need to comply
with the PCI standard.
However the route to compliance depends on the size and type of the organisation.
The two main types are:
 |
Merchants |
|
Service Providers |
The possible steps for compliance are:
Self-Assessment Questionnaire
This is a questionnaire that a merchant or service provider completes.
Onsite Review
An Onsite Review is an audit undertaken by a third-party known as a Qualified Security Assessor (QSA).
Network Security Scan
A network security scan is carried out by an Approved Scanning Vendor (ASV) on external facing IP addresses.
Typically those organisations who process a smaller number of credit card transactions are required to have a Network Security Scan on a quarterly basis and to complete the Self-Assessment on an annual basis.
Where a large number of credit card transactions (more than 6 million) are processed, an annual Onsite Review is
required as well as a quarterly Network Security Scan.
