Duration
3 days
Course Description
This course provides a comprehensive understanding of the Payment Card Industry Data Security Standard (PCI-DSS), guiding participants through its history, major revisions, and key compliance requirements. Participants will learn how to conduct assessments using Reports on Compliance (ROCs) and Self-Assessment Questionnaires (SAQs), and gain clarity on the eight types of SAQs applicable to different business scenarios.
Learning Objectives
By the end of this course, participants will:
- Understand the history and major revisions of PCI-DSS.
- Learn how the assessment process works, including ROCs and SAQs.
- Gain in-depth knowledge of all 12 PCI-DSS requirements.
- Implement secure network configurations and protect cardholder data.
- Apply strong access control measures and secure authentication practices.
- Develop and maintain security policies in compliance with PCI-DSS.
- Conduct regular monitoring, testing, and vulnerability assessments.
- Establish incident response plans to mitigate data breaches.
Chapter 1: Introduction to PCI-DSS
- History and evolution of PCI-DSS
- Overview of major revisions
- Compliance importance and benefits
Chapter 2: PCI-DSS Assessment Process
- Reports on Compliance (ROCs)
- Self-Assessment Questionnaires (SAQs)
- Understanding the 8 types of SAQs
Chapter 3: Requirement 1 - Build and Maintain a Secure Network
- Firewall configurations for cardholder data isolation
- Network documentation and segmentation
- Regular firewall rule reviews
Chapter 4: Requirement 2 - Protect Against Vendor Defaults
- Changing default configurations
- Isolating server functionality
- Securing device vulnerabilities
Chapter 5: Requirement 3 - Protect Stored Cardholder Data
- Encryption protocols and techniques
- Key lifecycle and management
- Data retention and deletion policies
Chapter 6: Requirement 4 - Protect Cardholder Data in Transit
- Encryption standards (WPA/WPA2)
- Masking plaintext PANs
- Secure communication protocols
Chapter 7: Requirement 5 - Protect Systems Against Malware
- Antivirus solutions and their management
- Regular scanning and updates
- Threat detection and prevention
Chapter 8: Requirement 6 - Develop and Maintain Secure Systems
- Secure coding practices
- Regular vulnerability assessments
- Patch management policies
Chapter 9: Requirement 7 - Restrict Access to Cardholder Data
- Need-to-know access principles
- Role-based access control
- Access approval processes
Chapter 10: Requirement 8 - Authenticate Access to System Components
- Unique user IDs
- Multi-Factor Authentication (MFA)
- Password management policies
Chapter 11: Requirement 9 - Physical Security Measures
- Visitor identification and authorization
- Media storage, transport, and destruction
- Physical access controls
Chapter 12: Requirement 10 - Track and Monitor All Access
- Logging solutions and event tracking
- Required logging data points
- Ensuring log integrity and retention
Chapter 13: Requirement 11 - Regularly Test Security Systems
- Authorized and rogue access point audits
- Penetration testing and vulnerability scans
- Incident response testing
Chapter 14: Requirement 12 - Maintain an Information Security Policy
- Company-wide security policy implementation
- Employee and third-party screening
- Policy enforcement and review processes
Programme scope, delivery arrangements and suitability are confirmed during enquiry.