PCI DSS Compliance

TruPCI Compliance Suite

TruPCI is for organizations who do not have compliance requirements outside of PCI DSS or who have an immediate need to achieve and maintain PCI DSS compliance. The most complete PCI DSS solution on the market, TruPCI helps you manage your entire PCI DSS program, not just file SAQs and perform scans.

For processors, independent sales organizations (ISOs), and acquiring banks, TruPCI offers the most cost effective solution on the market for merchant validation. As important, TruPCI offers the industry’s most complete knowledge base and training, providing best-in-class on-line support so that merchants can navigate the compliance process successfully. Finally, TruPCI’s flexible architecture allows us to create the right solution for you and your merchants. You decide what features are important and we adjust our pricing accordingly.

More specifically, TruPCI helps organizations meet the following objectives:

• Conduct annual assessments (e.g. SAQ, ROC)
  Merchants must submit either a Self-Assessment Questionnaire (SAQ) or a Report on Compliance (ROC) annually. TruPCI provides an on-line mechanism for merchants to determine which SAQ/ROC to complete, complete the required SAQ/ROC, track remediation items to closure and generate reports. In addition, TruPCI offers detailed, on-line guidance on how to interpret and answer each question.
• Meet annual PCI DSS training requirements (6.5, 12.6.1, 12.6.2)
  The PCI DSS has two specific employee security awareness requirements (Requirement 12.6.1 and 2): annual employee training and annual policy acceptance. Through TruPCI, your employees can take a 30 minute e-Learning course “Protecting Sensitive Data: What You Should Know” and review and accept your organization’s security policies. You have a record of each employee’s completion status so that you can confirm that each employee has met the training and policy acceptance requirements. Also included at no additional charge is a single license to our 30 minute e-Learning course for managers and business owners entitled “Protecting Sensitive Data: What Risk Owners Should Know.” This course covers the PCI DSS, threats to payments data, common compliance mistakes, and recommended actions to secure your customers’ data.
  
  For information technology employees who manage the payments environment, ANX offers an additional course “Complying with the Payment Card Industry Data Security Standard: What IT Professionals Should Know.” This course offers four to six (4-6) hours of training designed to help the IT Professional interpret and apply the PCI DSS requirements to their payments environment. The course is divided into four roles to cover all IT disciplines: network engineering, systems administration, application development, and an ‘all’ role for individuals with multiple responsibilities.
• Perform quarterly external vulnerability scans
  Quarterly external quarterly vulnerability scans are a PCI DSS requirement (11.2) and are an important requirement for any merchant that transmits credit card data over their internal network (as opposed to a phone line). In addition, your acquiring bank/processor may request confirmation of a passing scan along with an annual Self-Assessment Questionnaire (SAQ) to validate that you are in PCI DSS compliance.
  
  TruPCI provides merchants and service providers with a low cost, self service scanning solution which meets PCI DSS requirements.
• Track compliance status throughout the year
  The Payment Card Industry Data Security Standard (PCI DSS) consists of more than 200 requirements which in turn generate hundreds, if not thousands, of mandatory tasks to achieve and maintain compliance. Manual tracking the performance of these tasks and associated evidence to auditably demonstrate compliance is infeasible. TruPCI includes default task templates for each element of the payment process including payment applications, systems, network devices, and paper-based processes. An organization can use these templates to quickly generate a checklist of recurring tasks, assign them out to those responsible, and then manage the process throughout the year. When it comes time for the annual assessment, the internal or external assessor can view task history and associated evidence for each PCI DSS requirement and SAQ question, greatly simplifying the assessment process.