Doc Tool - PCI DSS Online For Free

PCI DSS Audit: How to Prepare for Your Audit Step 1: Define your PCI DSS audit scope. Step 2: Complete a risk assessment. Step 3: Find a Qualified Security Assessor (QSA) Step 4: Conduct a gap analysis. Step 5: Complete your QSA-led assessment. Step 6: Address security concerns. Step 7: Monitor your PCI DSS controls.

To become PCI compliant, a business typically must do three things: Meet the requirements set out by the Payment Card Industry Security Standards Council. Complete an assessment that shows how secure a business's systems and practices are. Most small businesses can perform a self-assessment.

PCI compliance requires adherence to the six control objectives, or goals, outlined in the PCI DSS: Build and maintain a secure network and systems. Protect cardholder data. Maintain a vulnerability management program. Implement strong access control measures. Monitor and test networks regularly.

Every business that is trying to show PCI DSS compliance must complete the appropriate Self-Assessment Questionnaire (unless your organization is at a higher compliance level which requires a Report on Compliance by a qualified security assessor in an on-site audit).

In that case, you need to hire a PCI-qualified security assessor (QSA) to conduct an audit that identifies your company has met the required PCI data security standard. Additionally, you also need to submit an annual report on compliance (ROC).

Based on your organization's PCI DSS level, you must fill out a Self Assessment Questionnaire (SAQ) or a Report of Compliance (ROC). Both are annual recurring expenses. So ensure that you include the audit cost in your cost calculation. The average market cost for an SAQ ranges between $5,000 to $20,000.

Governed by the Payment Card Industry Security Standards Council (PCI SSC), the compliance scheme aims to secure credit and debit card transactions against data theft and fraud.