Corona Crisis : PCI SS paves way with Remote Assessment

The recent outbreak of Corona virus has hampered the operations across the globe affecting all economies and nations alike. The lockdown has bought few industries to a standstill while others are still managing to continue their day to operations via virtual means.

But even in uncertain times like these, PCI DSS compliance is a requirement that can’t be dropped. PCI SSC council has recognized these unusual circumstances and understands situation where onsite assessments won’t be possible owing to restricted travel entry. In lieu of the individual health and safety, PCI SSC has emphasized on  remote assessments providing guidance to the assessor community

Troy Leach, Sr VP, Engagement Officer PCI SSC discussed the necessary guidelines to be followed by assessor at these times.

Remote Assessments

Since, assessors may not be able to travel to an onsite location for assessment, they are advised to conduct remote assessments that ensures any validations being performed remotely are under necessary level of assurances of implementation and that all the requirements are met before signing off their ‘in place’ clause in the report of compliance

Maintaining the Integrity of Assessment

Necessary measures are recommended to be taken by the assessor to ensure that integrity of the assessment is maintained even in remote scenarios, ascertaining that personnel and system components under examine are same as in onsite assessment.

Report on Compliance must include the mode of assessment conducted and how an equivalent level of assurance was attained during the assessment, retaining all the relevant evidence as a part of assessment paperwork.

Local Qualified Assessor resources can be engaged for assistance, in case the primary QSA is unable to travel onsite. An approved subcontractor can be engaged in accordance to the QSA program requirements. And all the measures should be taken to ensure that the results of the assessment are in line with the onsite assessment, even though certain tests are meant to be done only in person and delay in such scenarios is unavoidable.

All the necessary queries about the assessment completion and how it may impact the compliance should be addresses to the acquirer of the applicable payment brands. The general guidance for the QSAs around online and remote assessments are available in FAQ 1455. Check it out  here.

QRC requests all our community members to stay safe, we put our clients in the centre of every key decision that is made. And assure in doing our best in implementing all business continuity measures until the pandemic is contained in scale and scope.