PCI DSS v3.0 Report on Compliance (ROC) Assessment Overview

PCI DSS v3.0 Report on Compliance (ROC) Assessment Overview Jeff Messer Director, TAAS 01/08/2015 1

Agenda 2 What / Why / Who ROC Schedule Request for Information (RFI) Process Overview Onsite Assessment Remote Assessment and Remediation Activities Draft ROC Report Quality Assurance and Draft Review Final Report Challenges from Experience Questions

What / Why / Who What is a ROC? o Report on Compliance Why do we need to do a ROC? o Because you’re a Level 2 merchant you are required to have an onsite assessment performed on an annual basis. Who is involved? o Business o IT 3

ROC Schedule Period 1 - Pre-Assessment o Documentation and Preparation o Cardholder Data Environment (CDE) Review All the People, Processes and Technologies, involved in Storing, Transmitting or Processing cardholder data (CHD). Period 2 – Assessment o ROC Process - Report on Compliance validation 4

ROC Process Flowchart 5

RFI Process - Overview The Coalfire RFI Process is intended to prepare for and facilitate a smooth PCI DSS assessment project. Successful completion of each RFI Phase is critical for meeting timeline expectations for the ROC. 6

RFI Phase 1 Phase 1 Documents o o o o o 7 Exec 1 – Business Description Exec 2 – Department Scope Identification Process Exec 3 – Dataflow Diagram(s) / Campus Scope Narrative Exec 4 – Network Diagram(s) Exec 5 – CDE Inventory

Exec 1 – Business Description Non-marketing explanation of: o o o o o o 8 Lines of business (e.g. retail, ecommerce, brick-n-mortar, etc.) Operating locations Revenues Number of employees Number of IT employees Major IT contract providers.

Exec 2 –Scope Identification Process Covers all of the methods and processes used to identify and document all instances of cardholder data (electronic / paper) Include any data discovery tools, manual or automated processes used to ensure that no cardholder data exists outside of the CDE. 9

Exec 3 – Dataflow Diagram(s) / Dept. Scope Narrative Describe all manners in which you accept and process payment card transactions from card data capture through settlement. Descriptions need to be accompanied with data flow diagrams that highlight the flow of CHD o Into the CDE o Throughout the CDE o Out of the CDE 10

Exec 4 – Network Diagram(s) Depicting the CDE All of the CDE boundaries How it is connected to (and/or segmented from) other networks. The diagrams should be both high-level and detailed. 11

Exec 5 – CDE Inventory CDE Inventory spreadsheet documents all in-scope systems that make up the CDE. The invent must be align with all information previously provided. Completion of this inventory is critical for scheduling and sampling purposes. 12

RFI Phase 2 Phase 2 Documents o Provide a complete “RFI Phase 2” document Mapping your documentation to all applicable PCI DSS requirements Identifying the Owner(s) for each and the Owner Contact(s) for each requirement. o Provide the documentation to Coalfire. o Onsite scheduling: Interviews (Interview Schedule) Assessments Evident Collection 13

RFI Phase 2 Spreadsheet 14

Onsite Assessment Assess all in-scope facilities Conduct interview sessions with key personnel Perform all necessary technical validation 15

Remote Assessment & Remediation Remote Assessment o This time period is to complete any review activity that was not completed during the onsite assessments. Remediation o This time period is to validate that any issues identified during the assessment, have been addressed (i.e. remediated). 16

Draft ROC Report We begin writing the ROC report as soon as the Phase 1 documentation is collection and is complete. After all review and remediation activities have completed, the draft report will be issued. 17

Quality Assurance and Draft Review The draft report will be reviewed both by the Campus and by Coalfire’s QA process. The draft will go through iterations until it successfully completes both reviews. 18

Final Report Campus approves the content of the draft report. Final Report on Compliance (ROC) and the associated Attestation of Compliance (AOC) will be signed and issued. 19

Challenges from Experience Take this seriously, you don’t want to be a headline. Most merchants overestimate their level of control and underestimate the scope of their environment. Read the PCI DSS v3.0 to ensure you understand the requirements. Think out of the box, don’t assume you know your scope, take time to validate it. Surprises found during the penetration testing and vulnerability scanning Remediation always takes longer than you think. 20

Questions? 21