Given emerging threats to the global payment card business especially for card-not-present transactions, which have been marred with fraudulent activities, there is need for organizations that collect, process, store and transmit cardholder information to be Payment Card Industry Data Security Standard (PCIDSS) compliant in order not to become a loose end for the thriving fraudulent activities. Stolen payment card records via unsecured applications, servers and/or networks has led to huge financial losses, reputational damages and litigations against financial institution, card issuers, acquirers or switches/processors may be found to be negligent or cases that is no fault of theirs. Insurance companies are not also left out and have ended up paying huge damages to cardholders and financial institutions that transferred their risk accordingly. Therefore, it is important for all stakeholders who handle cardholder information in the course of their business to improve their processes as well as comply with relevant requirements of (PCIDSS). Enforcement of PCIDSS requirement by regulatory institutions and operators within the payment card sector cannot be overemphasized. As such, this material provided the reader with test procedures that will ensure compliance with PCIDSS requirement. You will find a comprehensive audit procedure that will guide you on those things to look out for during the subject mentioned audit.
This material will among other things look at control issues and vulnerabilities associated with payment card (debit, credit and prepaid) processes, systems and applications and how they can be mitigated. It provided a comprehensive audit checklist for PCIDSS requirements and how to practically verify the existence of necessary controls and practices that will show compliance with the requirements. Particular attention will be paid to the following areas: policies and procedures guide the operation of card business, card brand, processors and switch payment policies, change management, application security (Postilion realtime, Post Office, Post Card, Transware/TWCMS, ITC, FIMI, EMP, etc), database security, card operations (priming, production, stocking & distribution), data backup and redundancy/resilience, vendor/third party service management (card personalizaton vendors, switches, processors, acquirers, issues, etc), acquiring and terminal security, encryption key management, vulnerability assessment and management, infrastructure/server security (operating systems security), credit card portfolio management, network security, instant card and PIN issuance.