Hosting Provider: Applications / software Hardware Infrastructure / Network Physical space (co-location) Storage Web Security services 3-D Secure Hosting Provider Shared Hosting Provider Other Hosting (specify): Managed Services (specify): Systems security services IT support Physical security Terminal Management System Other services (specify): Payment Processing: POS / card present Internet / e-commerce MOTO / Call Center ATM Other processing (specify): Account Management Fraud and Chargeback Payment Gateway/Switch Back-Office Services Issuer Processing Prepaid Services Billing Management Loyalty Programs Records Management Clearing and Settlement Merchant Services Tax/Government Payments Network Provider Others (specify): Note: These categories are provided for assistance only, and are not intended to limit or predetermine an entity’s service description. If you feel these categories don’t apply to your service, complete “Others.” If you’re unsure whether a category could apply to your service, consult with the applicable payment brand. Part 2a. Scope Verification (continued) Services that are provided by the service provider but were NOT INCLUDED in the scope of the PCI DSS Assessment (check all that apply): Name of service(s) not assessed: Type of service(s) not assessed: Hosting Provider: Applications / software Hardware Infrastructure / Network Physical space (co-location) Storage Web Security services 3-D Secure Hosting Provider Shared Hosting Provider Other Hosting (specify): Managed Services (specify): Systems security services IT support Physical security Terminal Management System Other services (specify): Payment Processing: POS / card present Internet / e-commerce MOTO / Call Center ATM Other processing (specify):
No evidence of full track data, CAV2, CVC2, CID, or CVV2 data, or PIN data storage after transaction authorization was found on ANY system reviewed during this assessment. ASV scans are being completed by the PCI SSC Approved Scanning Vendor (ASV Name) Part 3b. Service Provider Attestation Signature of Service Provider Executive Officer Date: Service Provider Executive Officer Name: Title: Part 3c. Qualified Security Assessor (QSA) Acknowledgement (if applicable) If a QSA was involved or assisted with this assessment, describe the role performed: Signature of Duly Authorized Officer of QSA Company Date: Duly Authorized Officer Name: QSA Company: Part 3d. Internal Security Assessor (ISA) Involvement (if applicable) If an ISA(s) was involved or assisted with this assessment, identify the ISA personnel and describe the role performed: Part 4. Action Plan for Non-Compliant Requirements Select the appropriate response for “Compliant to PCI DSS Requirements” for each requirement. If you answer “No” to any of the requirements, you may be required to provide the date your Company expects to be compliant with the requirement and a brief description of the actions being taken to meet the requirement. Check with the applicable payment brand(s) before completing Part 4. PCI DSS Requirement Description of Requirement Compliant to PCI DSS Requirements (Select One) Remediation Date and Actions (If “NO” selected for any Requirement) YES NO 1 Install and maintain a firewall configuration to protect cardholder data 2 Do not use vendor-supplied defaults for system passwords and other security parameters 3 Protect stored cardholder data
4 Encrypt transmission of cardholder data across open, public networks 5 Protect all systems against malware and regularly update anti-virus software or programs 6 Develop and maintain secure systems and applications 7 Restrict access to cardholder data by business need to know 8 Identify and authenticate access to system components 9 Restrict physical access to cardholder data 10 and monitor all access to network resources and cardholder data 11 Regularly test security systems and processes 12 Maintain a policy that addresses information security for all personnel Appendix A1 Additional PCI DSS Requirements for Shared Hosting Providers Appendix A2 Additional PCI DSS Requirements for Entities using SSL/early TLS