If you have always filed an SAQ A to maintain PCI compliance, recent 11th hour changes may have upended your world, or at least your ability to maintain PCI compliance.
Written by: Daryl Jackson
This comprehensive eBook breaks down all the updates made to the new v4.0 standard.
Written by: Jordan Wiseman
Verizon Business turned to Online’s QSA team to contribute anonymized ROC data and expert insights for the 2024 Payment Security Report. The result? A comprehensive guide to payment security trends that equips organizations with the tools to strengthen their PCI DSS compliance while uncovering opportunities for security program enhancements.
Authenticated scans are now required to satisfy internal vulnerability scanning. This eBook explores how this new change will impact PCI security programs.
Written by: Jeff Man
A Service Provider engaged Online's PCI Advisors to address technical requirements. Our QSA team evaluated network and application environment using BMC Discover. Online was able to help this Client obtain Compliance Attestation, improving their security and compliance posture for future sustainability.
ACME Corporation, a globally operated large equipment manufacturer, turned to Online’s QSA team to help them clarify the PCI DSS for requirements and advise on scope reduction. Not only did ACME exceed their scope reduction goals, but they ended up with some very pleasant side-effects.
PCI REQUIREMENTS LIBRARY
PCI SAQ A Changes: Course Correction Update
The PCI SSC has clarified key SAQ A eligibility requirements, shifting security responsibility for embedded payment pages (iFrames) to Third-Party Service Providers (TPSPs). Find out what this means f...
PCI SAQ A Changes: Course Correction or Alternate Route?
On January 30th, the PCI SSC announced that merchants completing Self-Assessment Questionnaire (SAQ) A, would be exempt from complying with PCI DSS requirements 6.4.3 and 11.6.1 under certain conditio...
The Time is Now for Future-Dated PCI Requirements
Hey PCI Champions! Don’t Breathe a Sigh of Relief Just Yet Congratulations on snagging your v4.0 Report on Compliance (ROC) and Attestation of Compliance (AOC)! You might be thinking, “Finally, we’re ...
What the PIN?! 3 Entities that MUST Comply with the PCI PIN Standard
Are you an acquirer or processor that manage PIN data, a vendor that provides systems that handle PIN data, or a merchant that stores, processes, or transmits PIN data? If so, you will want to underst...
Disk Level Encryption: The 3.2.1 Magic Bullet has been Left Behind
Prepare for a transformative shift in cardholder data security with PCI DSS v4.0. With native disk encryption no longer a shield, organizations worldwide must swiftly adapt, revisiting encryption stra...
Take a Pit Stop – 5 Point Inspection Questions to Consider NOW before the 4.0 Last Lap
2023 is flying by. Before you can say March 2024, v3.2.1 of the PCI DSS will be retired. Do you know what your organization needs to do to cross the v4.0 finish line, and how much time it will take? N...
#1 Preventative Measure to Stop Network Breaches
Despite the significant changes introduced with PCI DSS v4.0, there are many bedrock requirements that did not change. This article serves to highlight an often neglected, but extremely important face...
Three Steps to Avoiding an “In Place With Remediation” Status
Three steps to avoiding the new "In Place with Remediation" status and using the seven P's to help -- prior proper planning prevents p*#s poor performance! A few months ago, we published a blog “There...
DSS 4.0 Clarifies, Strengthens MFA Requirements
MFA under v4.0: No more admin bypass. And no more accessing the CDE without it. Start now and make sure you’ve got the time to set up MFA correctly, and securely. Your users will thank you, your QSA w...
Authenticated Vulnerability Scanning
One of the most significant changes introduced in PCI DSS v4.0 involves the documented approach for performing internal vulnerability scans. The internal vulnerability scanning requirement (now 11.3.1...
Monitor the Monitoring
There are two notable changes that may require a fair bit of runway to fully meet the existing requirement to monitor your critical security control systems. On March 31st, 2022 PCI DSS v4.0 was relea...
There is Trouble Brewing: In Place with Remediation
What could possibly go wrong with calling out a non-compliant status, or “In Place with Remediation,” on your Attestation of Compliance? Do you have a storm brewing you are yet aware of? On March 31st...
Understanding the Changes to Appendix A1: Multi-Tenant Service Providers
Are you a SaaS? Do you offer various shared services to merchants and other service providers with access to resources or services being logically controlled or partitioned to keep resources contained...
Incident Response - Unexpected PAN Identified
Mistakes with PAN happen! Data leaks, memory dumps, or debug logs can accidentally contain sensitive information and can leak data into unexpected places in your environment. It is now a requirement t...
Web Application Firewall - Automated Technical Solution
There are now two options to meeting the new requirement 6.4.2 for a web application firewall: WAF or RASP. Notice I didn’t say manual code review! On March 31st, 2022 PCI DSS v4.0 was released. Today...
Roles and Responsibilities | Who's Driving What?
If you don’t have documented and employee acknowledged roles and responsibilities for every role that is part of your PCI scope of assessment, you may need a long roadway to get this in place. On Marc...
PCI v4.0 - Requirement 7: All Things Accounts and Access Reviews
Remember the good ole days when Requirement 7 was all about general and privileged user accounts? Well, those days are done as of March 31, 2025! On March 31st, 2022 PCI DSS v4.0 was released. Today’s...
The Customized Approach | Part 1
Have you ever been off-roading? Full-on four-wheel-drive, low gear, creeping over rocks, or blasting through snowbanks? It’s quite an exhilarating experience. I liken the updates made to the Customize...
The Customized Approach | Part 2
The recent release of PCI DSS v4.0 may give the mistaken impression that there is a lot of time for organizations to prepare for any required changes to people, processes, and technologies. While this...
