Document Comparison

Payment Card Industry Data Security Standard

PCI DSS v4.x Report on Compliance Template - Frequently Asked Questions Revision 2

1. Overview of PCI DSS v4.x Reporting 1.1 What has changed in the PCI DSS v4.x ROC Template? Refer to the following documents for details:

• PCI DSS ROC Template Summary of Changes from ROC Template v4.0 to v4.0.1.

• PCI DSS v4.x ROC Template

• Frequently Asked Questions r1 (for updates to the PCI DSS v4.0 ROC Template).

ASSESSMENT APPROACH WHEN TO USE THIS APPROACH Customized Approach Focuses on the Customized Approach Objective of each PCI DSS Requirement (if applicable), allowing entities to implement controls to meet the requirement’s stated Customized Approach Objective in a way that does not strictly follow the defined requirement. The customized approach supports innovation in security practices, allowing entities greater flexibility to show how their current security controls meet PCI DSS requirements. Refer to the PCI DSS Requirements and Testing Procedures v4.x for the Customized Approach Objectives, included with each applicable requirement. Note: If used by the assessed entity, the assessor completes and includes Appendix E Customized Approach Template with the ROC. Note: Compensating Controls are not an option for the Customized Approach Defined Approach The traditional method for implementing and validating PCI DSS and uses the Requirements and Testing Procedures defined within the standard. The entity implements security controls to meet the …

These results are summarized in Section 1.8 Summary of Assessment.

Here is sample layout of Part II: Section 7 Findings and Observations that shows the headings and reporting options:

Requirement Description 1.1 Example Requirement Description

PCI DSS Requirement 1.1.1 Example Requirement Assessment Findings (select one) Select If below Method(s) Was Used In Place Not Applicable Not Tested Not in Place Compensating Control* Customized Approach* ☐ ☐ ☐ ☐ ☐ ☐ Describe why the assessment finding was selected. Note: Include all details as noted in the “Required Reporting” column of the table in Assessment Findings in the ROC Template Instructions. *As applicable, complete and attach the corresponding documentation (Appendix C, Appendix E, or both) to support the method(s) used.

Testing Procedures Reporting Instructions Reporting Details: Assessor’s Response 1.1.1.a Example testing procedure Example reporting instruction 1.1.1.b Example testing procedure Example reporting instruction

Overall Assessment Result

• Compliant but with Legal Exception

• Non-Compliant The Assessment Findings in Part II shows the results for each individual PCI DSS requirement, and is one of the following:

• Not in Place 2.4 For the sample layout shown in Q 2.2, for “Select If Below Method(s) Was Used,” how does an assessor determine whether to select “Compensating Control” or “Customized Approach” for a requirement? If an entity has implemented a compensating control to meet some or all aspects of a requirement, “Compensating Control” is selected. In this case, the assessor has performed expected testing of the compensating control and selects the corresponding Assessment Finding that accurately represents the results of the testing. The assessor also completes and includes the Appendix C Compensating Controls Worksheet in in the PCI DSS v4.x ROC Template.

See PCI DSS v4.x Appendices B and C for more details about compensating controls.

If an entity has implemented …

• No CHD in the environment.

• Acquirer asks for a report only covering a subset of requirements (for example, using the PCI DSS Prioritized Approach).

Testing Assessor performs the appropriate testing and validation on all requirements. Any PCI DSS requirement where testing verifies the non- applicability of that requirement is marked as Not Applicable, which would NOT result in a Partial Assessment.

Assessor performs appropriate testing and validation only for the specified requirements. The remaining requirements are marked as Not Tested, which would result in a Partial Assessment.

5. General Questions 5.1 Is use of the ROC Template for PCI DSS v4.x mandatory? Yes. The PCI DSS ROC Template is mandatory for QSAs to use when documenting a detailed PCI DSS assessment (as contrasted with a less detailed PCI DSS self-assessment documented in a Self-Assessment Questionnaire (SAQ)). All response sections in the ROC Template must be completed (even if to note that sections …

Other changes must be minimal and the format of the ROC Template for PCI DSS v4.x must remain unchanged. This includes reordering of sections, which is NOT allowed. Nothing is permitted to be removed from Parts I and II of the document, including sections or requirements determined to be not applicable. Those sections and/or requirements must remain in the completed ROC Template with the “Not Applicable” result documented instead. Edits to the footers are explicitly not allowed.

• Addition of Company logos and legal verbiage

• Changes to the customizable title page

• Changes to the page headers

• Additions of table rows

• Removal of the ROC Template PCI SSC cover page, the Document Changes table, the ROC Template Table of Contents, and ROC Template Instructions The following changes are prohibited:

• Edits to the footers

• Changes to the format of the ROC Template for PCI DSS v4.x

• Reordering or removal of sections or requirements

• Removal of any content from Parts I and II including reporting instructions in those sections The following should be considered when making changes:

• Ensure that any content added by the QSA is clearly distinguishable from the content that is part of the published PCI SSC document. All additions should be considered carefully, and such content should be added only to the customizable title page of the document.

• After the table of contents at the beginning of the document, the following disclaimer must be included in both in English and the translated language: "Note

Note

• Requirements that are future-dated are considered as best practices until the future date is reached. During this time, organizations are not required to validate to future-dated requirements. While validation is not required, organizations that have implemented controls to meet the new requirements and are ready to have the controls assessed prior to the stated future date are encouraged to do so. Once the designated future date is reached, all future-dated requirements become effective and applicable.

6. Account data storage 6.1 My client feels that the Storage of Account Data table in the completed ROC combines a lot of sensitive data into one document. How can I address their concerns, but complete the ROC Template appropriately? It is acceptable in the ROC Template at 4.3 for the QSA to attest that the storage of account data has been separately documented according to 4.3 and to include a document reference to identify …