PCI DSS Self-Assessment Completion Steps Identify the applicable SAQ for your environment refer to the Self-Assessment Questionnaire – Instructions and Guidelines document on PCI SSC website for information. Confirm that your environment is properly scoped and the eligibility criteria for the SAQ you are using (as defined in Part 2g of the Attestation of Compliance). Assess your environment for compliance with applicable PCI DSS requirements. Complete all sections of this document: Section 1 (Part 1 & 2 of the AOC) Assessment Information and Executive Summary. – Section 2 PCI DSS Self-Assessment Questionnaire (SAQ A-EP) – Section 3 (Parts 3 & 4 of the AOC) Validation and Attestation Details and Action Plan for – Non-Compliant Requirements (if applicable) Submit the SAQ and Attestation of Compliance, along with any other requested such as ASV scan reports—to your acquirer, payment brand or other requester. Understanding the Self-Assessment Questionnaire The questions contained in the DSS Question” column in this self-assessment questionnaire are “PCI based on the requirements in the PCI DSS. Additional resources that provide guidance on PCI DSS requirements and how to complete the assessment questionnaire have been provided to assist with the assessment process. An overview of some of these resources is provided below: Document Includes: PCI DSS Guidance on Scoping Guidance on the intent of all PCI DSS Requirements (PCI Data Security Standard Requirements and Security Assessment Details of testing procedures Procedures) Guidance on Compensating Controls SAQ Instructions and Guidelines Information about all SAQs and their eligibility criteria documents How to determine which SAQ is right for your organization PCI DSS and PA-DSS Glossary of Descriptions and definitions of terms used in the PCI Terms, Abbreviations, and Acronyms DSS and self-assessment questionnaires These and other resources can be found on the PCI SSC website (). Organizations are encouraged to review the PCI DSS and other supporting documents before beginning an assessment. Expected Testing The instructions provided in the Testing” column are based on the testing procedures in the “Expected PCI DSS, and provide a high-level description of the types of testing activities that should be performed in order to verify that a requirement has been met. Full details of testing procedures for each requirement can be found in the PCI DSS.
PCI DSS Self-Assessment Completion Steps Identify the applicable SAQ for your environment – refer to the Self-Assessment Questionnaire Instructions and Guidelines document on PCI SSC website for information. Confirm that your environment is properly scoped and the eligibility criteria for the SAQ you are using (as defined in Part 2g of the Attestation of Compliance). Assess your environment for compliance with applicable PCI DSS requirements. Complete all sections of this document: Section 1 (Part 1 & 2 of the AOC) – Assessment Information and Executive Summary. Section 2 – PCI DSS Self-Assessment Questionnaire (SAQ A-EP) Section 3 (Parts 3 & 4 of the AOC) – Validation and Attestation Details and Action Plan for Non-Compliant Requirements (if applicable) Submit the SAQ and Attestation of Compliance, along with any other requested as ASV scan reports—to your acquirer, payment brand or other requester. Understanding the Self-Assessment Questionnaire The questions contained in the “PCI DSS Question” column in this self-assessment questionnaire are based on the requirements in the PCI DSS. Additional resources that provide guidance on PCI DSS requirements and how to complete the questionnaire have been provided to assist with the assessment process. An overview of some of these resources is provided below: Document Includes: PCI DSS (PCI Data Security Standard Requirements and Security Assessment Procedures) Guidance on Scoping Guidance on the intent of all PCI DSS Requirements Details of testing procedures Guidance on Compensating Controls SAQ Instructions and Guidelines documents Information about all SAQs and their eligibility criteria How to determine which SAQ is right for your organization PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms Descriptions and definitions of terms used in the PCI DSS and self-assessment questionnaires These and other resources can be found on the PCI SSC website (). Organizations are encouraged to review the PCI DSS and other supporting documents before beginning an assessment. Expected Testing The instructions provided in the “Expected Testing” column are based on the testing procedures in the PCI DSS, and provide a high-level description of the types of testing activities that should be performed in order to verify that a requirement has been met. Full details of testing procedures for each requirement can be found in the PCI DSS. such assessment
SAQ_A-EP_v3%20%285%29.docx