12.8.4 – Maintain a program to monitor service providers PCI DSS compliance status annually. 12.8.5 – Maintain details which PCI DSS requirements are managed by each service provider and which by the entity. 31/07/2015 30/06/2017 Complete Self-Assessment SAQ A and record compliance with merchant services. PCI-DSS Compliance Plan - SAQ B For PDQ Dial Out Terminals 14/05/2015 31/07/2015 Requirement 3 – Protect cardholder data: 3.2 - Is sensitive data deleted after authorisation:- Review policies and procedures and examine deletion processes. 3.2.1 – Magnetic strip data is not stored – Examine data sources if applicable. 3.2.2 – Card Verification code is not stored – Examine data sources if applicable. 3.2.3 – PIN is not stored - Examine data sources if applicable 3.3 – Is PAN masked? only personnel with a legitimate business need can see the full PAN. – Review policies and procedures, review roles. 27/04/2015 31/07/2015 Requirement 4 – Encrypt transmitted cardholder data across open public networks.
27/04/2015 27/04/2015 Requirement 12 – Maintain an Information Security Policy: Review policies and procedures 12.1 – Is a security policy established, published, maintained and disseminated to all relevant personnel – Review the information security policy 12.1.1 – Is the security policy reviewed annually and updated when the environment changes – review the policy and interview responsible personnel. 12.3 – Are usage policies for critical technologies (remote access, wireless, laptops, tablets, removable electronic data, email usage, internet usage) developed to define proper use 12.3.1 – Explicit approval by authorised parties to use the technologies – Review usage policies, interview responsible personnel. 12.3.3 – A list of all such devices and personnel with access - Review usage policies, interview responsible personnel. 12.3.5 – Acceptable uses of the technologies - Review usage policies, interview responsible personnel. 12.4 – Do security policy and procedures clearly define information security responsibilities for all personnel - Review usage policies, interview responsible personnel. 12.5 – Are the following information security management responsibilities formally assigned to an individual or team 12.5.3 – Establishing, documenting and distributing security incident response and escalation procedures to ensure timely and effective handling of all situations - Review usage policies and procedures. 12.6 – Is a formal security awareness program in to make all personnel aware of the importance of cardholder security. – Review security awareness program. 12.8 – Are policies and procedures maintained and implemented to manage service providers with whom cardholder data is shared, or that could affect the security of cardholder data as follows 12.8.1 – Maintain a list of service providers, observe agreements. 12.8.2 – Maintain a written agreement with service providers acknowledging their responsibility for the security of cardholder data. 12.8.3 – List the established process for engaging service providers including due diligence prior to engagement. 12.8.4 – Maintain a program to monitor service providers PCI DSS compliance status annually. 12.8.5 – Maintain details about which PCI DSS requirements are managed by each service provider and which by the entity. 12.10.1 – Has an incident response plan been created to be implemented in the event of system breach – Review incident response plan and procedures.