PCI DSS compliance software
What it is
The Payment Card Industry Data Security Standard (PCI DSS) sets security requirements for any environment that handles cardholder data. The PCI Security Standards Council maintains the standard. Version 4 is the current version. It has 12 requirements that cover network security, access control, logging, vulnerability management and secure software. Card brands and acquiring banks enforce PCI DSS through their contracts.
Who needs it
PCI DSS applies to any business that stores, processes or transmits cardholder data. That covers merchants that accept card payments online or in store. It also covers service providers that handle card data for merchants. Each card brand sets merchant levels, usually by annual transaction volume. Level 1 merchants face the strictest validation. Your acquiring bank confirms your level and the validation it requires.
What auditors check
- A current scope that maps every system that stores, processes or transmits cardholder data, with network and data flow diagrams.
- Firewall rules that restrict traffic into and out of the cardholder data environment, reviewed at least every six months.
- Secure configuration standards for each system type, with vendor default passwords changed before use.
- Protection of stored account data, with the primary account number rendered unreadable through encryption, truncation, tokenization or hashing.
- Strong cryptography for cardholder data sent over open, public networks.
- Critical and high security patches installed within one month of release.
- Unique IDs for every user, with multi factor authentication for all access into the cardholder data environment.
- Audit logs for systems in scope, retained for at least 12 months, with the latest three months available for immediate review.
- Internal vulnerability scans at least once every three months, plus external scans by an Approved Scanning Vendor (ASV) on the same schedule.
- Penetration tests at least once a year and after significant changes, with segmentation testing at least once a year when segmentation is in use.
- A written security policy that management reviews at least once a year, with security awareness training for personnel.
- A tested incident response plan for suspected compromise of cardholder data.
How Oncrypt gets you ready
Oncrypt builds your PCI DSS readiness from the controls that assessors test first. Our scans cover your website and its trackers, since a skimming script on a checkout page is a common failure. We also check your email and domain settings, your cloud accounts and the systems where card data lives. Each finding lands in your score with a clear fix and an owner. Our in house pentest team tests the systems that matter most. Our compliance lead checks the evidence. The evidence vault keeps it ready for your next review. A QSA or your SAQ validates the result. Oncrypt gets you audit ready for that review.
Overlap with other frameworks
Questions
Does Oncrypt make us PCI DSS compliant?
No. Oncrypt does not issue a PCI DSS validation. A QSA or your SAQ validates your compliance. Your acquiring bank or card brand accepts that result. Oncrypt builds your readiness, so you stay audit ready.
What is the difference between an SAQ and a Report on Compliance?
An SAQ is a self assessment questionnaire that the merchant or service provider completes. Your acquiring bank or card brand decides which SAQ type applies. A Report on Compliance (ROC) is written by a Qualified Security Assessor (QSA) after an assessment. Level 1 merchants and service providers usually need a ROC.
What is an ASV scan?
An ASV scan is an external vulnerability scan run by an Approved Scanning Vendor on the PCI SSC list. PCI DSS requires these scans at least every three months and after significant changes. A passing scan has no vulnerabilities rated 4.0 or higher on the CVSS scale.
Which merchant level applies to us?
Each card brand sets its merchant levels, usually by annual transaction volume. Your acquiring bank confirms your level and the validation it requires. Level 1 merchants face the strictest requirements.
Does a payment provider remove our PCI DSS duties?
It can shrink them. Outsourcing card handling to a validated provider reduces the cardholder data environment you must assess. You still own the systems that touch card data. Collect the provider's Attestation of Compliance (AOC) each year.
Start with the gaps that matter most
Talk to us about your framework. We will show you what to fix first and what your auditor will ask for.