PCI Policies, Procedures and Evidence – What is expected?

Alastair Stewart
|
Senior Consultant at URM
|
PUBLISHED on
08
August
2022

While it’s one of the areas that IT and security departments find challenging, documentation (and compliant evidence) is what makes for a happy and satisfied PCI Qualified Security Assessor (QSA), and, more importantly, a successful PCI compliance audit!  Successful compliance programmes invariably depend on the accurate and consistent recording of events and the adherence to well-defined policies and procedures.

These documents ensure all staff are aware of their obligations, as well as defining the necessary actions to ensure a secure and compliant environment is achieved. With a number of PCI requirements, certain documents will need to be reviewed periodically or the instructions contained therein carried out at specific intervals.  

If the actions in question (i.e. firewall rule reviews / external vulnerability scans) are not performed as instructed, the entire compliance initiative may be jeopardised.  Organisations are well-advised to analyse their documentation and evidentiary requirements and summarise these centrally, where the content and resulting actions can be tracked.  

Security policies and procedures are not a new concept and, coupled with the multitude of security standards that have been developed over the past few decades, there’s no need to start from scratch and be overly creative.  

As long as the documents are clear, concise, deliver the intended message, are customised to the environment in question and elicit the necessary behaviour, the document set will achieve the desired outcome.   It is essential that you ensure all PCI control statements which require explicit documentation are included in the relevant documents.  This will save you both time and resources when addressing this necessary, albeit challenging, task.

The list of documents and evidence artefacts that act as the baseline for achieving compliance with the PCI DSS is very extensive.

Not all documents will be obligatory for all organisations, however, a significant number will need to have been implemented in order for a successful outcome to be achieved.  If these documents, procedures and activities geared towards producing the necessary evidence are in place, you are well on the way to attaining compliance.  To illustrate the type of documents and evidence (by no means exhaustive!) you will typically need to develop and implement, here is starter for ten!:

Documents

  1. Network device management policy
  2. Wireless scanning procedure (rogue access points)
  3. Remote access policy (staff/vendor)
  4. Device configuration standards
  5. Visitor policy
  6. Operational security procedures

Evidence

  1. Network diagrams
  2. Dataflow diagrams
  3. Incident response test
  4. Role-based access matrix
  5. Vulnerability scans
  6. Risk register
  7. Third party contracts (soft copy)

Alastair Stewart
Senior Consultant at URM
Alastair is one of the most experienced and proficient Payment Card Industry Qualified Security Assessors (PCI QSAs) in the UK. He has completed in excess of one hundred successful reports on compliance (RoCs) against different PCI DSS versions along with supporting the completion of self-assessment questionnaires (SAQs).
Read more

Do you need support in meeting your annual PCI DSS penetration testing requirements?

As a CREST-accredited penetration testing organisation, URM can complete internal and external penetration tests.
Thumbnail of the Blog Illustration
Information Security
Published on
9/8/2022
5 Ways to Reduce Your PCI DSS Scope

Almost all organisations that implement the Payment Card Industry Data Security Standard (PCI DSS) struggle with the scope of the applicability....

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
13/6/2022
PCI DSS v4 – Changes at a Glance

After several years wait, and to surprisingly little fanfare, the PCI SSC released the new version of the PCI Data Security Standard (DSS).

Read more
Thumbnail of the Blog Illustration
Information Security
Published on
11/4/2024
PCI DSS v4.0: Network Security Controls

URM’s blog explains the wording changes in Requirement of the PCI DSS v4.0, offering advice on how organisations can select and use the most appropriate NSCs.

Read more
URM’s in-depth knowledge of cybersecurity best practices and the Cyber Essentials framework helped us strengthen both ours and our client’s security posture while ensuring full compliance. Their consultants were professional, approachable, and incredibly thorough, offering practical advice tailored to the specific needs. The Cyber Essentials Plus assessment was conducted with great efficiency, and URM’s supportive approach meant we felt well-prepared at every stage. Thanks to their expertise, we successfully achieved certification for us and our clients, giving us (and our clients) greater confidence in our cybersecurity resilience.
contact US

Let us help you

Let us help you in your compliance journey by completing the form and letting us know how we can best support you.