Download

Co published the updated DSS, now at version 1.1, which is accepted by all brands andinternational regions, and it refreshed most of the supporting documentation.PCI Co is technically an independent industry standards body, and its exact organizationalchart is published on its Web site.Yet it remains a relatively small organization, primarilycomprised of the employees of the brand members. In fact, the role of answeringe-mails sent to info@pcisecuritystandards.org rotates every month among the representativesof the card brands.The industry immediately felt the positive impact of PCI Co.The merchants and serviceproviders can now play a more active role in the compliance program and the evolution ofthe standard, while the Qualified Security Assessor Companies (QSACs) and ApprovedScanning Vendors find it much easier to train their personnel.Approved Assessor and Scanner CompaniesWhy PCI Is Important • Chapter 8 271PCI Co now controls what companies are allowed to conduct on-site DSS complianceaudits.These companies, known as Qualified Security Assessor Companies (QSACs), havegone through the application and qualification process, having had to demonstrate compliancewith tough business, capability, and administrative requirements. QSACs also had toinvest in personnel training and certification to build up a team of Qualified SecurityAssessors (QSAs).NOTEQSACs are only permitted to conduct on-site DSS audits. They are not automaticallygranted the right to perform perimeter vulnerability scans.QSACs have to recertify annually, and have to re-train their internal personnel.Theexact qualification process and the requirements are outlined on PCI Co’s Web site, so wewill not go into it in detail; however, of particular interest are the insurance requirements.QSACs are required to carry high coverage policies, much higher than typical policies forthe professional services firms, which becomes important later.NOTEQSACs are approved to provide services in particular markets: USA, AsiaPacific, CEMEA (Central Europe, Middle East, and Africa), Latin America andthe Caribbean, and Canada. The qualification to service a particular marketdepends on QSAC’s capabilities, geographic footprint, and payment of appropriatefees.