It’s a fact that the full, PCI DSS v4.0.1 ROC template requires the QSA to complete 577 fields in Part I and 3552 fields in Part II. Part I being focused upon the Assessment Overview, with Part II split between Sampling & Evidence and Findings & Observations. Completing 4,129 fields across all Requirements is a challenging task that demands accuracy in order to deliver a high quality ROC assessment. A Physical Storage Service Provider or Multi-Tenant Service Provider ROC’s may be shorter, but still require the same attention to detail.

The 27k1 RMS has been developed as a digitized version of the analogue, ROC assessment template. In developing this software, 27k1 has devised numerous automated and time saving features that intelligently, auto-populate the ROC , AOC and Customized Control worksheets.

Of the 4,129 fields, the 27k1 RMS auto-populates 3755 fields across Parts 1 and 2.

Starting by selecting the correct ROC assessment type and establishing the Eligibility Criteria, the logic built into the software instantly populates hundreds of fields that are drawn from a tailored, Response Library. Specific fields will immediately be justified as “Not Applicable” and hundreds more will move to an “In Progress” status, waiting for the QSA to continue the work until it is ready for QA.

Because Parts I and II have been integrated, the QSA can easily move around the digitized ROC assessment, referencing evidence, interviews, observations and findings, all of which being hyper-linked to the application and located within a secure data repository. Clear reports across every Section and Requirement highlight the status of the ROC, which may be shared with the client.

The QSA may work in an agile way, such that QA may be completed on a section-by-section basis, rather than wait for the entire ROC assessment to have been prepared for final review. Work completed by the QSA and QA team within the 27k1 RMS software, will output into their branded, analogue ROC template.

Feedback from QSA companies using the system suggest that up to 7 days may be saved from a 10 day ROC assessment, based on a 7-hour working day. At $1,000 per day, this will translate to an immediate return on investment, saving the QSAC around $7,000 per ROC assessment.

Here’s what 27k1’s QSA clients had to say:

“The 27k1 ROC Management System has proven invaluable with the updates to PCI DSS and the revised ROC reporting template, which requires numerous radio buttons to be selected and completed. The application is highly user-friendly, and the customer support is exceptional, with the team responding to inquiries and requests almost immediately. The time savings we’ve achieved by using the 27k1 ROC Management System has allowed us to dedicate more effort to guiding our customers on how best to meet PCI DSS requirements.  Overall, the application is a great tool, completely recommend it to maximize efficiencies and increase productivity.”  Tania Nicholas, QSA, Director of PCI Compliance Services at 3Factor (https://www.3factor.com/).

“I want to thank everyone at 27k1 for their support in recent weeks as we completed our first ROC using the 27k1 RMS tool! Your openness to our suggestions for streamlining our work has been invaluable. This collaboration improves the product for everyone, and I’m so excited to be a part of this user community.” Jacqueline Bertram – Senior Director, Cyber Security – RGP – RGP global consulting and project execution for business transformation

“The 27K1 PCI DSS auditing tool offers a comprehensive and user-friendly solution for managing our PCI DSS compliance. Its intuitive interface made the auditing process seamless and efficient.” Ritchie Jeune – Managing Director, Home – Evolution Global Security Company

Brigantia Partners Limited is a reseller of “best-in-class” cybersecurity software, based in Thirsk, Yorkshire.  The business supports numerous security software vendors and thousands of channel partners, helping them to grow and in turn, secure their customers’ businesses. Given the nature of the software products and services that they sell, the client base and commercial relationships, Brigantia recognised the need to achieve ISO 27001 certification to demonstrate that they operate a robust and secure Information Security Management System. The task of setting up the ISMS and achieving ISO 27001 certification was charged to Rupert Abrahams. Brigantia Partners received their ISO 27001 certificate in December 2023 and this is what Rupert had to say:

“The 27k1 application has been great at simplifying and guiding us through the process of achieving the ISO 27001 accreditation. When we started our implementation, we were using multiple spreadsheets to manage our Information Security management system. We bought the application to try and simplify this and since using it the whole process has been a lot easier. We have found that we can manage all aspects of our system within it including the documentation, asset management and running the audits and risk assessments.

It is very easy to use and navigate as the application is laid out very clearly with different sections and intuitive to use, and we required only minimal training. When we have need any support 27k1 have responded very quickly and dealt with our queries.

When doing our full audit, the application made it so easy to demonstrate our compliance against the controls and the reports module was particularly helpful in showing activities that had been carried out. Our auditor did say that he thought the application was particularly helpful in guiding us through the process and the proof of this is that we breezed through our certification!”

Rupert Abrahams – Information Security and Technical Manager

Brigantia Partners Limited – www.brigantia.com – 0203 358-0090

QSA’s are highly qualified, very experienced and hold deep, PCI DSS subject matter knowledge. They need these attributes since completing the PCI DSS v4.0 Report On Compliance is complex, stressful and frequently leads to burnout!

Regarding PCI DSS v4.0 – QSA’s start by understanding the client’s organisation, then review them against:

• Part 1: Assessment Overview – 46 pages
• Part 2: Breakdown of section requirements – 440 pages
• Validation fields – 700: covering Interviews, Observations, Document fields etc

As if that wasn’t enough…. try adding the new INFI – Items Noted For Improvement report. Along with completing all the N/A fields for the unused Customised Approaches or Compensating Control Worksheets, QSAs now need to document whether there is an INFI or not for each and every PCI DSS requirement. Moreover, this could involve the creation of an internal report that potentially lists all 260 PCI DSS Requirements as either being N/A or as not having any INFI’s.

Did I say that this is complex, stressful and frequently leads to burnout?

Taking into account the time constraints wrapped around a Level 1 assessment, the Quality Assurance process and the commercial demands to achieve validation and signature before moving onto the next ROC, I now appreciate how demanding this role has become.

The 27k1 RMS – ROC Management System

27k1 Ltd recently introduced the 27k1 RMS to QSA companies attending the PCI Community Meeting, Portland, Oregon. The 27k1 RMS digitizes the ROC, so that the compliance work completed by QSA’s within the software, automatically populates the Level 1 assessment. We believe that the software will save up to 6 days from the completion of each assessment and reduce burnout.

The responses that we received from 27k1 RMS system demonstrations was overwhelming. Feedback from the QSA community confirmed that this purpose built software, intended for use by qualified QSA companies is unique, especially because a license agreement between the PCI SSC and 27k1 will allow the integration of their ROC template in word format into the software, so that the QSA’s compliance work will automatically populate the ROC. 27k1 will be the first company to offer this incredible feature.

For a no-obligation, system demonstration, simply contact: www.27k1.com/contact

To manage this situation, 27k1 Ltd has integrated the PCI DSS v4.0 standard with its 27k1 ISMS software, creating 2 class leading compliance solutions:

1. The 27k1 ROC Management System (RMS), for use by PCI SSC approved QSA’s

2. The 27k1 SAQ Management System (SAQMS), for use by Level, 1, 2 and 3 Merchants

For QSA companies, completing the Report On Compliance for their Level 1 clients is an arduous task. The ROC requires accurate responses to 12 Requirements sections comprising in excess of 300 questions, with responses supported by Risk Assessments, Appendices, Network Scans, Diagrams, Interviews and more.

From selection of a Self-Assessment Questionnaire – SAQ, the correct PCI DSS v4.0 requirements are presented along with actions that need to be undertaken. Full progress reporting assists this activity, along with feature rich, automated reports.

Selection of more than one SAQ will enable a combined approach to be selected, automatically populating SAQ D with any exclusions nominated as “Not Applicable”, with a supporting justification.

Companies and ISA’s using the 27k1 SAQMS will benefit from this functionality as well as being able to run Risk Assessments on all IS Assets, manage Documents, take Audits, control their entire ISMS and produce rich, granular reporting.

Compliance work within the 27k1 software automatically populates SAQs, Appendices, Worksheets and the AOC. The software retains this work, so that subsequent SAQ completion in following years is fully supported.

The system has been architected to enable remote access by QSA’s so that they can support their clients.

Jeremy Martin, Co-Founder at 27k1 will be demonstrating this ground-breaking software at September’s PCI SSC Community Meeting .

27k1 Ltd has agreed to showcase the ground-breaking, 27k1 PCI DSS v4.0 compliance software at the PCI SSC’s North America Community Meeting: Home – 2023 North America Community Meeting (pcisecuritystandards.org)

In addition to reserving an exhibition booth, 27k1 plan to sponsor a slot within the Tech Exchange. Jeremy Martin will demonstrate the way in which the software supports PCI DSS v4.0 compliance, automatically populating selected SAQs and the RoC from the compliance work completed across the requirements, controls and test requirements.

Full progress reporting with detailed actions assists this activity, along with feature rich, automated reports, so that Tech Exchange visitors will see how the software completes the Appendices, AoC and any CC worksheets that may have been used.

The system will support several types of organisation:

1. QSA companies that are engaged by Level 1 entities to provide a Report on Compliance.
2. Entities that possess in-house, ISA capability, that need the services of a QSA to validate their SAQ submissions.
3. Level 2 and 3 entities that wish to manage an advanced ISMS from which selected SAQ’s may be automatically completed by the system and combined into a SAQ D Merchant or Service Provider, as necessary.

The 27k1 PCI DSS software will enable risk assessments using the NIST Cyber Security Framework and will include a full list of PCI DSS v4.0 documents to support the compliance process.

In advance of the PCI SSC meeting, you can request a detailed, system review by contacting 27k1 at: Contact 27k1 – 27k1 ISMS

29.12.2022

The ever-present threat of payment card fraud and the increasing burden that comes with the effective management of your payment card program has made the implementation of a management system a business critical requirement.

Now, imagine being able to harmonise the management system of the ISO/IEC 27001:2022 standard with the robustness of the PCI DSS 12 requirements? This is exactly the approach taken by the 27k1 PCI DSS platform.

Employing the principles from Clause 6.1.3 of the ISO/IEC 27001:2022, Clauses 4 to 10 remain whilst the Annex A controls are replaced by the PCI DSS 12 requirements – creating a PCI DSS Statement of Applicability (SOA). This helps entities to create a suitable management system for the treatment of the risks to their payment card operations.

Consequently, entities can create a hybrid between two ‘Best in Class’ industry information security standards, aka:

• A Payment Card Security Management System (PCSMS)

Such an approach will help to meet some of the latest enhancements that arrived in March 2022 with the release of PCI DSS v4.0, e.g:

• #.1.1 – Requirement specific policies.
  • 27k1 includes a document management system.
• #.1.2 – Defined roles.
  • Incorporated as part of the 27k1 management system.
• – Risk Management.
  • 3.1 – Tactical Risk Assessments, supported through the 27k1 Risk Manager
• – PCI DSS Program Management.
• – PCI DSS Scope validation and documentation.

In addition, the 27k1 solution also helps to simplify the annual compliance submission by automatically populating the official Self-Assessment Questionnaires (SAQs) from the inputs into the 27k1 platform.

Furthermore, imagine the potential enhancements that can be gained:

• An effective management system to help ensure that all mandatory tasks have been assigned and tracked for completion.
• An integrated solution to ensure that all supporting documentation and evidence is easily accessible.
• The potential to use your PCSMS to have your payment card operations certified against ISO/IEC 27001:2022.
• The potential to use your ISO/IEC 27001:2022 certified payment card operations (PCSMS) to meet the requirements of GDPR article 42 – Certification, by an accredited certification body (GDPR article 43) / UK DPA 2018 – Chapter 2, Para 17.

The harmonisation between the management system, from the ISO/IEC 27001:2022, and the payment card specific PCI DSS security controls can help you to create a ‘Best in Class’ PCSMS, which in turn will enable you to simplify your PCI DSS compliance obligations and to significantly reduce the risks to your payment card operations.

About Jim Seaman

Jim is the founder of IS Centurion Consulting Ltd, based in Castleford, Yorkshire. Jim has been dedicated to the pursuit of security throughout his extensive career. He served 22 years in the RAF Police, covering a number of specialist areas including physical security, aviation security, information security management, IT security management, cybersecurity management, security investigations, intelligence operations, and incident response and disaster recovery.

He has successfully transitioned his skills to the corporate environment and now works in areas such as financial services, banking, retail, manufacturing, e-commerce, and marketing. He is highly qualified within the information security sector, applying his skills to help businesses enhance their cybersecurity and InfoSec defensive measures and work with various industry security standards.

Jim is a published author, writing definitive guides to PCI DSS compliance and Protective Security, the books being available to purchase on Amazon.

Computer security | IS Centurion Consulting Ltd | Castleford

“27k1 played a huge part in making our ISO27001 certification journey as simple as possible. With minimal training, it was very easy to use, and we were able to spin it up in no time at all. If we had any queries about the application the 27k1 team got back to us very quickly and were great to deal with.

We found navigating around the application very straightforward as each Management section is clearly laid out, allowing us to jump straight to information we needed as we progressed our alignment to the ISO27001 framework.

What made everything so simple for us, our consultants, and the auditors was the reports module. This easily generated everything our auditor needed to see around risk management, management reviews, alignment to the controls and so much more, where we were able to pass our audit with flying colours.”

Martyn Harvey, Technical Director

92c High Street, Billericay, Essex, CM12 9BT

www.sedcom.net

Social Value Portal works across 4 UK offices, employing around 120 personnel. The company is dedicated to enabling organisations to empirically measure their social performance and contribution to their communities. By proving social performance, companies and organisations build trust with their customers and suppliers. They lead with purpose, demonstrating sustainability, stakeholder engagement and environmental wellbeing. To do this, Social Value Portal has developed TOMS – a data driven software solution that measures National Themes, Outcomes and Measures, which proves exactly how the organisation and its’ suppliers are making a difference.

Given the quantity and sensitivity of data received, Social Value Portal required a software solution that would help them to protect this data and enable them to achieve ISO 27001 certification.

Social Value Portal chose the 27k1 ISMS software and this is what Peter Armitage had to say:

“The 27k1 application provided much needed clarity and structure in aligning the information security processes and documentation at Social Value Portal with the ISO27001 requirements. The application allowed us to clearly link assets, documents, risks, and other organisational information against the controls, as well as tracking actions and managing our meetings and internal audits. During our full audit, the application and the reports that it generated made it straightforward to demonstrate our compliance against each control, and we were pleased to achieve accreditation within a year of working with the 27k1 ISMS.”

Peter Armitage, Director of Technology

Social Value Portal – https://socialvalueportal.com

For those companies that manage high volumes of financial transactions using credit cards and on-line payment systems, compliance is essential. Enforcement of compliance with PCI Standards and determination of any non-compliance penalties are carried out by the individual payment brands, not by the PCI SSC. Non-compliance, system breaches and data corruption within a merchant organisation carries the threat of sanctions or expulsion from the credit card provider.

PCI DSS v4.0 will become mandatory for all organizations that process or store cardholder data by March 2024. The proliferation of online transactions isn’t the only reason the PCI Council created the v4.0 standard. Recent years have also seen a surge in cloud use, the rise of contactless payments and cybercriminals using increasingly sophisticated methods of intrusion and fraud.

PCI DSS v4.0 is intended to improve payment card industry security and mitigate against the growing threats posed by cyber criminals. Recent initiatives include:

• Expanded multi-factor authentication requirements
• Updated password requirements
• New e-commerce and phishing requirements to address ongoing threats

The overall intention is to promote security as a continuous process, for example;

• Allocating clearly assigned roles and responsibilities for each requirement
• Providing guidance to help people better understand how to implement and maintain security
• Requirements for new reporting option to highlight areas for improvement and provide more transparency for report reviewers.

PCI DSS adds further information security requirements, hence v4.0 is a major overhaul that requires a complete refocus on the technology behind the way in which payment card data is processed, managed and secured.

If your organization isn’t up to speed on current practice, it will certainly need to apply expert resources in order to comply with the v4.0 requirements. Indeed, a shift in mindset and culture may also be needed, since compliance is not a one-off exercise, but a continuous process. The PCI DSS approach places emphasis on top-down organizational change and best practice alignment.

The following steps will guide your business towards attaining compliance within the allocated timeframe as well as avoiding any audit fines or publicised data breaches.

1. Create a detailed, auditable action plan for the implementation of PCI DSS v4.0, securing buy-in and resources from senior management.
2. Contrast PCI DSS v3.2.1 with PCI DSS v4.0 and upgrade to the new security requirements. For example, this will cover areas such as the protection of account data as opposed to the previous cardholder data. It may be necessary to restructure your network to adequately protect account data.
3. PCI DSS v4.0 emphasises the cultivation of a security mindset within the organization. Personnel must begin to view compliance as a continuous activity that protects sensitive data more so than simply a set of tasks designed to pass audits. Security and compliance teams should work together to implement a defined process for maintaining the security of the Cardholder Data Environment (CDE), including routine reviews of configurations and security.
4. Strengthen Security Configuration Management processes. Requirement 2 broadens the scope of SCM. Rather than focusing on vendor-defined defaults, the onus is now put on organizations to have their own security configuration program. In order to meet v4.0’s wider SCM scope, ensure that you monitor the configurations of networks, servers, firewalls, and all other components. SCM also helps auditors track compliance status over time. SCM tools help to reduce the time it takes to prepare for an audit and speed up the actual audit process as well.
5. Software solutions: The best way to achieve continuous PCI DSS v4.0 compliance is to deploy a total, software solution that supports the new, v4.0 controls, checks SCM and ensures that all assets are held securely. The 27k1 Enterprise Application has been developed with assistance from PCI DSS industry experts and will readily support compliance to PCI DSS v4.0.

Digital Transformation EXPO ( DTX ) is coming to ExCel LONDON on the 12th – 13th October and 27k1 Ltd will be taking its rightful place alongside the world’s leading IT brands and systems.

In addition to promoting the 27k1 ISMS software, we are delighted to announce that we shall be using this opportunity to launch the new, 27k1 ISMS Hybrid Software, which will extend the control sets within the software to support selected compliance standards.

Building on the ISO 27002 framework and 27k1 ISMS software platform, the 27k1 Hybrid software will now support PCI DSS version 4.0 – the latest, Payment Card Industry Digital Security Standard, published on March 31^st, 2022.

The PCI DSS is a global standard set by the PCI Security Standards Council (PCI SSC) and is designed to improve the security of payment card transactions and reduce credit card fraud. The standard is set by the PCI DSS Council – a global forum led by a policy-setting Executive Committee composed of representatives from American Express, Discover, JCB International, Mastercard, UnionPay and Visa Inc.

For those companies that manage high volumes of financial transactions using credit cards and on-line payment systems, compliance is essential. Enforcement of compliance with PCI Standards and determination of any non-compliance penalties are carried out by the individual payment brands, not by the PCI SSC. Non-compliance, system breaches and data corruption within a merchant organisation carries the threat of sanctions or expulsion from the credit card provider.

Whilst there’s no “certification” for PCI DSS compliance, merchants are required to prove their compliance through self-assessment i.e. by completing the SAQ and the AOC – Attestation of Compliance, subject to the annual volume of transactions.

The 27k1 Enterprise Application has been developed with assistance from PCI industry experts and will readily support compliance to PCI DSS version 4.

Come to DTX Europe and visit Stand NE17 to discuss your ISO 27001 or PCI DSS compliance needs with industry experts.