PCI Compliance

Account Data - Account data consists of cardholder data and/or sensitive authentication data. See Cardholder Data and Sensitive Authentication Data.

Aquirer - Entity, typically a financial institution, that processes payment card transactions for merchants. Acquirers are subject to payment brand rules and procedures regarding merchant compliance. See also Payment Processor

AOC - Acronym for “attestation of compliance.” The AOC is a form for merchants and service providers to attest to the results of a PCI DSS assessment, as documented in the Self- Assessment Questionnaire or Report on Compliance.

ASV - Acronym for “Approved Scanning Vendor.” Company approved by the PCI SSC to conduct external vulnerability scanning services.

Cardholder Data -  At a minimum, cardholder data consists of the full Primary Account Number (PAN). Cardholder data may also include the full PAN plus any of the following: cardholder name, expiration date and/or security code.

CDE - Acronym for “cardholder data environment.” The people, processes and technology that store,  process,  or transmit cardholder data or sensitive authentication data.

Compensating Controls  -  Compensating controls may be considered when an entity cannot meet a requirement explicitly as stated, due to legitimate technical or documented business constraints, but has sufficiently mitigated the risk associated with the requirement through implementation of other controls. Compensating controls must: (1) Meet the intent and rigor of the original PCI DSS requirement; (2) Provide a similar level of defense as the original PCI DSS requirement; (3) Be “above and beyond” other PCI DSS requirements (not simply in compliance with other PCI DSS requirements); and (4) Be commensurate with the additional risk imposed by not adhering to the PCI DSS requirement. Go to the PCI website for additional guidance on the use of compensating controls.

Critical Systems and Technologies - A system or technology that is deemed by the entity to be of particular importance. For example, a critical system may be essential for the performance  of a business operation  or for a security function to be maintained. Examples of critical systems often include security systems, public-facing devices and systems, databases, and systems that store, process, or transmit cardholder data. Considerations for determining which specific systems and technologies are critical will depend on an organization’s environment and risk-assessment strategy.

Data-Flow Diagram - A diagram showing how data flows through an application, system, or network.

DSS - Acronym for “Data Security Standard.”

Default Password - Pre-defined password to access a system, application, or device, usually set up by IT vendor. Default accounts and passwords are published and well known, and therefore easily guessed.

Encryption  -  Process  of   converting   information into an unintelligible form except to holders of a specific cryptographic key. Use of encryption protects information between the encryption process and the decryption process (the inverse of encryption) against unauthorized disclosure.

Forensics - Also referred to as “computer forensics.” The application of investigative tools and analysis techniques to gather evidence from computer resources to determine the cause of data compromises.

Forensic Investigator - PCI Forensic Investigators (PFIs) are companies approved by the PCI Council to help determine when and how a card data breach occurred. They perform investigations within the financial industry using proven investigative methodologies and tools. They also work with law enforcement to support stakeholders with any resulting criminal investigations.

Hacker - A person or organization that attempts to circumvent security measures of computer systems to gain control and access. Usually this is done in an effort to steal card data.

Information Security - Protection of information to ensure confidentiality, integrity, and availability.

IP - Acronym for “internet protocol.” Network-layer protocol containing address information and some control information that enables packets to be routed and delivered from the source host to the destination host. IP is the primary network-layer protocol in the Internet protocol suite.

Least Privilege - Providing the minimum access and/or privileges necessary to perform the roles and responsibilities of the job function.

Merchant - For the purposes of the PCI DSS, a merchant is defined as any entity that accepts payment cards bearing the logos of any of the five members of PCI SSC (American Express, Discover, JCB, MasterCard or Visa) as payment for goods and/or services. Note that a merchant that accepts payment cards as payment for goods and/or services can also be a service provider, if the services sold result in storing, processing, or transmitting cardholder data on behalf of other merchants or service providers. For example, an ISP is a merchant that accepts payment cards for monthly billing, but also is a service provider if it hosts merchants as customers.

Merchant Bank - A bank or financial  institution  that processes credit and/or debit card payments on behalf of merchants. Also called an “acquirer,” “acquiring bank,” “card processor,” or “payment processor.” See also Payment Processor

Monitoring - Use of systems or processes that constantly oversee computer or network resources for the purpose of alerting personnel in case of outages, alarms, or other predefined events.

Network - Two or more computers connected together via physical or wireless means.

Network Segmentation - Network segmentation isolates system components that store, process, or transmit cardholder data from systems that do not. Adequate network segmentation may reduce the scope of the cardholder data environment and, thus, reduce the scope of the PCI DSS assessment. See the Network Segmentation section in the PCI DSS Requirements and Security Assessment Procedures for guidance on using network segmentation. Network segmentation is not a PCI DSS requirement.

PAN - Acronym for “primary account number” and also referred to as “account number.” Unique payment card number (typically for credit or debit cards) that identifies the issuer and the particular cardholder account.

Patch - Update to existing software to add functionality or to correct a defect.

Payment Cards - For purposes of PCI DSS, any payment card/device that bears the logo of the founding members of PCI SSC, which are American Express, Discover Financial Services, JCB International, MasterCard Worldwide, or Visa, Inc.

Payment Processor - Sometimes referred to as “payment gateway” or “payment service provider (PSP)”. Entity engaged by a merchant/entity to handle payment card transactions on their behalf. While payment processors typically provide acquiring services, payment processors are not considered acquirers unless defined as such by a payment card brand. See also Acquirer.

PCI - Acronym for “Payment Card Industry.”

PCI DSS - Acronym for “Payment Card Industry Data Security Standard.”

PCI Compliant - Meeting all applicable requirements of the current PCI DSS, on a continuous basis via a business- as-usual approach. Compliance is assessed and validated at a single point  in time; however,  it is up to each merchant  to continuously follow the requirements in order to ensure robust security. Merchant banks and/or the payment brands may have requirements for formal annual validation of PCI DSS compliance.

PCI DSS Validated - Providing proof that all applicable PCI DSS requirements are met at a single point in time. Depending on specific merchant bank and/or payment brand requirements, validation can be achieved though the applicable PCI DSS Self-Assessment Questionnaire or by a Report on Compliance resulting from an on-site assessment.

Penetration Test - Penetration tests identify ways to exploit vulnerabilities in order to defeat the security features of system components. Penetration testing includes network and application testing, as well as controls and processes around the networks and applications, and occurs from both outside the environment (external testing) and from inside the environment (internal testing).

Policy - Organization-wide rules governing acceptable use of computing resources, security practices, and guiding development of operational procedures

Procedure - Descriptive narrative for a policy. Procedure is the “how to” for a policy and describes how the policy is to be implemented.

PTS - Acronym for “PIN Transaction Security,” PTS is a set of modular evaluation requirements managed by PCI Security Standards Council, for PIN acceptance at POI terminals. Please refer to www.pcisecuritystandards.org.

Public Network - Network established and operated by a third- party telecommunications provider for specific purpose of providing data transmission services for the public. Data over public networks can be intercepted, modified, and/ or diverted while in transit. Examples of public networks include, but are not limited to, the Internet, wireless, and mobile technologies.

QSA - Acronym for “Qualified Security Assessor.” QSAs are qualified by PCI SSC to perform PCI DSS on-site assessments.

Risk Assessment - Process that identifies valuable system resources and threats; quantifies  loss  exposures based on estimated frequencies and costs of occurrence; and (optionally) recommends how to allocate resources to deploy countermeasures to minimize total exposure.

ROC - Acronym for “Report on Compliance.” Report documenting detailed results from an entity’s PCI DSS assessment.

SAQ - Acronym for “Self-Assessment Questionnaire.” Reporting tool used to document self-assessment results from an entity’s PCI DSS assessment.

Scoping - Process of identifying all system components, people, and processes to be included in a PCI DSS assessment. The first step of a PCI DSS assessment is to accurately determine the scope of the review.

Security Policy - Set of laws, rules,  and  practices that regulate how an organization manages, protects, and distributes sensitive information.

Service Provider - Business entity that is not a payment brand, directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This also includes companies that provide services that control or could impact the security of cardholder data. Examples include managed service providers that provide managed firewalls, IDS and other services, as well as hosting providers and other entities.

Threat - Condition or activity that has the potential to cause information or information processing resources to be intentionally or accidentally lost, modified, exposed, made inaccessible, or otherwise affected to the detriment of the organization.

Untrusted Network - Network that is external to the networks belonging to an organization and that is outside of the organization’s ability to control or manage.

Virtual Payment Assistant - A virtual payment terminal is web-browser-based access to an acquirer, processor or third-party service provider website to authorize payment card transactions, where the merchant manually enters payment card data via a securely connected web browser. Unlike physical terminals, virtual payment terminals do not read data directly from a payment card. Because payment card transactions are entered manually, virtual payment terminals are typically used instead of physical terminals in merchant environments with low transaction volumes.

Vulnerability - Flaw or weakness which, if exploited, may result in an intentional or unintentional compromise of a system.