Maestro Global Rules (PDF) - MasterCard

Security
8.10 Site Data Protection Program
8.10.2 Compliance Validation Tools
As defined in the implementation schedule in Rule 8.10.5 of this rulebook,
Merchants and Service Providers must validate their compliance with the
Payment Card Industry Data Security Standard by using the following tools:
1. Onsite Reviews: The onsite review evaluates a Merchant’s or Service
Provider’s compliance with the Payment Card Industry Data Security
Standard. Onsite reviews are an annual requirement for Level 1 Merchants
and for Level 1 and 2 Service Providers. Merchants may use an internal
auditor or an independent assessor recognized by the Corporation as
acceptable. Service Providers must use an acceptable third party assessor
as defined on the SDP program Web site at www.mastercard.com/sdp.
Onsite reviews must be conducted in accordance with the PCI Security
Audit Procedures document available at www.pcisecuritystandards.org.
2. The Payment Card Industry (PCI) Self-Assessment Questionnaire: The PCI
Self-Assessment Questionnaire is available at www.pcisecuritystandards.org.
To be compliant, each Level 2, 3, and 4 Merchant and each Level 3 Service
Providers must generate acceptable ratings on an annual basis.
3. Network Security Scan: The network security scan evaluates the security
measures in place at a Web site. To fulfill the network scanning requirement,
all Level 1, 2, and 3 Merchants, and all Service Providers, as required by the
implementation schedule, must conduct scans on a quarterly basis using a
vendor listed on the PCI SSC Web site. To be compliant, scanning and risk
remediation must be conducted in accordance with the guidelines contained
in the Payment Card Industry (PCI) Security Scanning Procedures available
at www.pcisecuritystandards.org.
8.10.3 Vendor Compliance Testing
As part of the SDP Program, the Corporation provides a vendor compliance
testing process for vendors that provide network scanning services. Technical
requirements for network scanning vendors are provided in the PCI DSS
Security Scanning Procedures available at www.pcisecuritystandards.org.
For more information, Acquirers should visit the SDP program Web site at
www.mastercard.com/sdp.
At this Web site, the Corporation also will post a listing of all acceptable onsite
assessors for the purposes of meeting the onsite review requirement.
©1993–2012 MasterCard. Proprietary. All rights reserved.
8-18 9 November 2012 • Maestro Global Rules