Contents
What is a PCI service provider?
The PCI Security Standards Council defines a service provider this way: Business entity that is not a payment brand, directly involved in the processing, storage, or transmission of cardholder data. This also includes companies that provide services that control or could impact the security of cardholder data.
Does PCI require network segmentation?
PCI network segmentation is a key security practice—not a requirement—for any company that wants to protect its cardholder data and reduce its PCI DSS compliance scope.
What is a PCI segment?
The PCIe specification uses the word PCI segment group to define a numbering per PCR (simply put the PCI segment group is the base address of the extended CAS mechanism of each PCR, so there is a one-to-one mapped natively). Due to their isolation property, the ports of the PCR are called PCIe Root Port.
What do service providers need to know about PCI DSS?
Level 1 service providers must pass a PCI DSS audit in place by a Qualified Security Assessor (QSA). Level 2 service providers must evaluate themselves annually with the Self-Assessment Questionnaire SAQ-D. However, most service providers are expected to make an appropriate assessment for level 1 regardless of their level.
Who are the level 2 service providers for PCI?
Besides, the institutions that carry out the following activities are defined as level 2 service providers: Level 2 service providers that ensure PCI compliance are not added to and are not listed on Visa’s List of PCI DSS Compliant Service Providers.
Do you have to validate compliance with PCI?
That seems straightforward enough. Merchants, therefore, must validate compliance with the PCI DSS. One of the requirements that the SSC has beefed up in the last few years is the requirement that a merchant understand who their service providers are and that they have proper agreements with those service providers.
What is the definition of a merchant in PCI?
So, let’s first tackle the merchant question. The PCI Security Standards Council (SSC) defines a merchant this way: