This is because many organisations rely on external suppliers to provide a variety of core services, products and systems. For example, your business will likely be reliant on an external IT company, accountancy firm, cloud service provider, website developer, digital marketing agency, or payment provider. 

Each of these external suppliers will, in turn, be relying on external parties themselves, creating a network of co-joined organisations. The net result is a large, complex supply chain. 

Somewhere in this network, there could be a potential system flaw, a disgruntled member of staff or a number of vulnerabilities that could potentially lead to an incident or event, which would affect anyone in this supply chain. Often, we refer to this being the weakest link.

For example: 

Fastly 

Fastly are a cloud computing company that offers a content delivery network. Their customers include a number of high-profile websites including Amazon, Reddit, PayPal and Spotify. This meant that when Fastly’s system failed, all those websites could not retrieve their data and were forced offline. It would appear that the cause was a software bug that one of their customers triggered. The consequences could have been potentially more significant than downtime.

Target

A vulnerability in Target’s supply chain affected them back in 2013. This was a payment card breach through the refrigeration company Fazio Mechanical, who had access to Target’s systems to carry out maintenance. It is understood the supplier received an email containing Malware, which stole credentials to the online portal they used for Target.

British Airways 

More recently, an attacker gained access to BA’s network through login credentials provided to a third-party provider of cargo services. From here, the attacker was able to gain access to other parts of BA’s network and access log files containing 108,000 payment card details. This was part of a testing feature that someone had not disabled. The attackers also managed to gain access to the BA website through files they accessed containing code, and then redirect customer payment card data to a different website.

Ticket Master 

Ticket Master was using a chat-bot feature on its website, hosted by a third party, on its online payment page. This gave an attacker access to customer financial details. This potentially affected 9.4m of Ticketmaster’s customers across Europe, with 60,000 payment cards belonging to Barclays bank customers being subjected to known fraud.

Service providers and cyber security risk

The cyber security risks to the service providers businesses use become their own cyber security risks. This risk could be anything from a business email compromise through to credential stuffing.

If a cyber criminal wants to attack a larger organisation, often the easier route is to go through their suppliers, because this is normally an easier target. Their cyber defences are often nowhere near as well funded as those of larger organisations.

Suppliers can provide a route to a larger organisation’s supply chain. This means security is part of the onboarding requirement for contractors working with Government-controlled organisations. The MOD, NHS, local authorities, and increasingly, larger organisations who have identified supply chain risk within their risk management require proof of good security from their suppliers.

Supply chain requirements

The requirements for supply chain are normally determined by the perceived risk and the classification of data that the external organisation could potentially access. It might be a self-assessed Cyber Essentials, an externally verified Cyber Essentials Plus, ISO 27001, a pentest, or proof of Payment Card Industry compliance – or any combination thereof. It is a requirement to have a SOC/ SIEM solution in place for critical national infrastructure providers, for example.

In addition, since the GDPR came into force in May 2018, supply chain due diligence has become part of the accountability of a data controller. This has led to a ream of third party security questionnaires asking for evidence of controls, numerous policies and assurance. 

Ultimately, if the data controller has not carried out due diligence on their supply chain, they could be ultimately to blame for any breach that originated from the third party that affected their data, as in the example of BA and Ticketmaster.

So where do you start?

You need to map out which third party suppliers you use. Which classification of data do they have access to? And consider not only carrying out your own security checks, but also a full risk analysis of the impact an incident originating with them could have on your organisation. Could it be critical to your operations? Could it affect your customers’ data? Or could it affect your ability to operate?

Understand what ‘appropriate technical and organisational controls’ are in place, and bear in mind that this could be subjective. It may sound harsh, but can you really trust the reassurances you have been provided? Is there any third-party independent assurance or testing that you can rely on?

Though Cyber Essentials and Cyber Essentials Plus are great certifications, they are only a moment in time. So how do you know they are maintaining these standards throughout the year, between assessments? Also consider whether a self-assessed Cyber Essentials is the appropriate level of certification required for your risk assurance. Or would an independent verification provide more substantial assurance?

Ongoing supply chain security

As far as ongoing supply chain assurance, consider looking for that UKAS certified ISO 27001 (International Standard for Information Security). This is a risk-based management system of continual improvement for information security.

Web apps, websites, supplier sites etc could be independently pentested to ensure they do not contain vulnerabilities that could effectively leave a door open for an attacker, who could then use it as a route to your data.

Has the supplier put in place robust training and staff awareness around GDPR and Cyber security? And can they evidence this is their training records?

Also consider how, if a supplier needs to access your systems, you can ring fence that access to the minimum they need to carry out that function, for the minimum time. Where possible, you should set up multi-factor authentication rather than rely on just a username and password. If you have an outsourced IT company that needs to access your system remotely, make sure this is not a continually open door, but just for an authorised, pre-arranged moment in time. 

Check out the NCSC Principles of Supply Chain Security. This is effectively about identifying the supply chain, understanding the risks and putting measures in place to mitigate these.

Final thoughts on supply chain security

Everyone should be bearing in mind supply chain security nowadays. It doesn’t matter how much resource you put into making sure your cyber security is in good shape. If you are reliant on an external provider that doesn’t take it quite so seriously, it could have a significant impact on your operations and bottom line. 

It’s also worth looking at gaining accreditations yourself, as a means of helping differentiate yourself from your competition. Increasingly, larger organisations require their suppliers to have measures in place to prove they’re secure, so get ahead of the game, and your competitors, by achieving recognised security accreditations.

What should I do next?

If you need any help, feel free to contact the team at Securious, the South West’s leading cyber security company. They have provided the content on this site and are passionate about helping businesses and organisations understand and improve their cyber security.

If you have any questions, a member of the team would be more than happy to speak with you – just fill in the contact form below, or get in touch with them on 01392 241110, or info@securious.co.uk

Penetration testing is an attempt to safely exploit your IT systems to determine whether they’re vulnerable to attack. It includes a series of tests, carried out by a specialist penetration tester, who looks for vulnerabilities in your systems that cyber criminals could exploit.

Why would I want penetration testing?

• Ensure your critical assets/data are secure by identifying vulnerabilities so you can protect your environment from malicious attacks by mitigating critical threats, which reduces the likelihood of a breach 
• Evidence that your systems have been tested to demonstrate to customers, business partners and stakeholders that it takes security seriously
• It may help you meet regulatory compliance requirements (like PCI DSS)

What happens during a penetration test?

We start with a scoping call, identifying the boundaries we’re working within. We’ll agree on the requirements and outcomes of the testing, before moving on to testing your systems. Our penetration testers follow a proven methodology with a series of simulated tests to identify any weaknesses in your defences – whether internally or externally. We adhere to an agreed set of rules of engagement before, during and after every penetration test.

Often it is the combination of a series of weaknesses in your systems that allows attacks, rather than a single vulnerability. That’s why our tests combine a series of lower-risk exploits in a particular sequence, to determine whether they would have any effect.

We test against the OWASP top 10 and detail the penetration test findings in a report that includes guidance around the vulnerability, impact, threat and the likelihood of a breach within your organisation. It highlights the potential risks and recommends where additional resources should be applied to protect your systems.

We will provide a comprehensive combined technical and summary report, detailing our findings and any remediation points, and will go through these at the planned debrief within five days of pentest completion.

What does a tester need to know before starting?

Typically, penetration testers will want to know at least the following:

• The list of targets, in detail
• What the targets are (Network Infrastructure, Web Application, API, etc.)
• In the case of a web application or API, a rough approximation to the number of endpoints/pages
• The sensitivity of the data on the systems in scope
• Where the systems are situated
• If there are any third parties (web hosts, managed service providers)
• Who these third parties are, with written permission allowing testing
• The level of access you would like the testers to have

How often should we pentest?

Penetration testing should be performed on a regular basis. This ensures that you can detect and respond to any newly discovered threats or emerging vulnerabilities that could lead to a system compromise by attackers.

Furthermore, penetration tests should also be carried out whenever:

• Significant changes to your infrastructure have taken place
• Additional locations or branch offices are opened
• You suspect or have fallen victim to an attack

What are the different types of penetration tests?

What is Black Box Testing?

Black box testing, in the context of penetration testing, is a method of vulnerability assessment whereby the tester attacks a target with the same level of knowledge and permissions as a genuine malicious actor might have. Typically, this means the test begins with the tester receiving no information on internal workings, and no credentials or permissions.

While black box testing can offer valuable insight by using the same methodologies that a real attacker might, it is important to understand that the expected result from such a test is unlikely to include details of the potentially-critical vulnerabilities that could be detected during a white box test.

What is White Box testing

Conversely, white box testing involves the provisioning of a tester with the very knowledge and permissions denied from black box testers. This provides the assessor with the ability to probe the target for vulnerabilities present within the application’s core; an area hidden from a black box tester.

Performing this type of testing allows organisations to more accurately understand the risks present in their applications and services by revealing vulnerabilities that are presented only to end users with permissions greater than nil, and real attackers who have managed to crack the outermost layer of security.

Crucially, white box testing is not exclusive of black box testing; meaning a white box assessment includes everything involved with a black box test, but also includes testing of otherwise unreachable areas.

What should I do next?

If you need any help, feel free to contact the team at Securious, the South West’s leading cyber security company. They have provided the content on this site and are passionate about helping businesses and organisations understand and improve their cyber security.

If you have any questions, a member of the team would be more than happy to speak with you – just fill in the contact form below, or get in touch with them on 01392 241110, or info@securious.co.uk

Click here to learn more about our penetration testing services

ISO 27001 is the international standard for Information Security. It provides a framework for an information security management system. This enables organisations to manage the security of assets like finance information, intellectual property, employee details or information entrusted by third parties.

Who is ISO 27001 for?

ISO 27001 is a great tool for organisations of any size and in any sector to use to keep their information assets more secure. It allows the business to demonstrate that it complies with current international best practice, and that it is effectively securing information assets and managing the risks around them. It also ensures that the organisation constantly improves its systems and processes to fit evolving needs.

Why would I want it?

• Use as a tool to manage GDPR compliance
• Prove you have a system in place to continually review and improve your information security. This improves credibility with customers, business partners and staff
• Bid for contracts with larger organisations who require the certification
• Minimise the evidence required for larger organisation to complete their due diligence
• Identify your information assets and their value, so you can make informed decisions to mitigate risks and ensure efficient spending

What does it involve?

There are several steps involved in achieving ISO 27001:

Firstly, it’s important to have a solid understanding of ISO 27001. This includes what it is, and the importance of managing your assets, risks and incidents. At this stage, it is important to determine your scope and understand the Plan, Do, Check, Act approach (which you may be familiar with through HSE).

• The next step covers the importance of leadership and identifying your Information Security Management System (ISMS) team, allocation of resources, competence, and communication.
• Then we can move on to the planning stage, creating objectives and deciding how we’ll achieve them
• The planning stage also includes identifying information assets and building an asset register so that you can move on to identifying the risks to these assets.
• Risk assessment is also part of the planning stage, including risk methodology, risk assessments and building the risk register
• The final part of the planning involves determining risk treatment to mitigate the risks to an acceptable level.
• At this stage we also create the Statement of Applicability. This takes all the controls in Annexe A of ISO 27001 and determines whether they are applicable
• Once you understand what you are protecting and the controls you have identified, you can implement the plans to mitigate risks that your information assets may be exposed to.
• Performance Evaluation and improvement helps us to check that what we have put in place is working and then feed this back into opportunity for improvement. This will include a full internal audit, and feedback into the ISMS Team.

About implementation

The implementation will involve completion of relevant policies, procedures and forms and the ISMS manual to communicate how to maintain the Information Security Management System. We normally phase these within the levels so that this is not simply a document completion exercise, but something that fulfils the need at that particular stage.

Once implementation is complete then you are ready for a stage one audit to determine that you have an ISMS in place.

This is followed by a stage two audit which then checks to see if the ISMS is working.

Once the accreditation body is satisfied that you have met the standard, they will issue you with your certification.

The most important goal for us is to share knowledge and ensure that the organisation implementing ISO 27001 is competent and confident to maintain this system as part of their business as usual.

How long does it take?

We have managed to implement ISO 27001 within a 12 week process for some clients. However generally an implementation takes around 3-6 months (sometimes longer depending on resource availability and scope of the organisation)

How much does it cost?

We tailor our ISO 27001 consultancy service to your individual needs and circumstances. So please get in touch and we’ll provide you with a quote based on your situation and requirements.

Alternatively, we’ve pioneered the  Securious ISO 27001 Academy. We work with businesses in a series of online workshops, for just £2,895 +VAT which includes all the necessary templates.

What should I do next?

If you need any help, feel free to contact the team at Securious, the South West’s leading cyber security company. They have provided the content on this site and are passionate about helping businesses and organisations understand and improve their cyber security.

If you have any questions, a member of the team would be more than happy to speak with you – just fill in the contact form below, or get in touch with them on 01392 241110, or info@securious.co.uk

So what is Cyber Essentials?

Cyber Essentials is a great first step towards making your systems more secure. It also helps you prove to suppliers that you are taking cyber security seriously.

Cyber Essentials certifications are suitable for organisations of all sizes. They are backed by the government and supported by The National Cyber Security Centre and the Information Commissioner.

And why should you want it?

Cyber Essentials helps you guard against 80% of the most common forms of cyber-attacks and includes automatic cyber liability insurance.

It is increasingly required if you want to provide services to large clients so they can be sure you aren’t a weak link in their supply chain.

What about Cyber Essentials Plus?

This is the big brother version and it covers the same controls as Cyber Essentials, only a third party (like us) verifies that the responses on the self-questionnaire are correct. This means it has considerably more credibility with third parties, which is why it’s increasingly required of any supplier to the Ministry of Defence, and encouraged for those working with government departments, local authorities and large organisations. Read more about Cyber Essentials Plus here

Ok, so how do you get it?

Cyber Essentials consists of a simple self-assessment questionnaire that asks you about what you have in place to protect your business from cyber threats. It covers 5 specific ‘controls’ that have been produced by the government and industry bodies.

To understand these better, let’s run through them:

1) Keep your devices and software up-to-date

Ensuring that all your devices’ operating systems and applications are up-to-date is very important, because manufacturers and developers regularly release patches to address security vulnerabilities that have been discovered. Cyber Essentials will enable you to identify if you are running unsupported software, and if your supported applications / operating systems are up-to-date.

If your devices and software aren’t up to date, it’s like having no cyber front door at all

2) Protect yourself from viruses and other malware

Protecting your systems with anti-virus software, intrusion detection/prevention systems would be akin to having CCTV or a security guard at your entrance, alerting you to potential threats and even stopping them on your behalf. Most popular operating systems include effective virus and threat protection… if all the modules are enabled. How is your configuration?

Having no anti-virus or intrusion protection is like leaving your cyber front door wide open

3) Control who has access to your data and services

Would you let everyone you know have a key to your home? No way! Cyber Essentials helps you take control of who has access to your data and services. Often clients don’t understand the significance of administrator and standard user accounts, and yet getting this wrong could result in an intruder having access to far more than you’d like.

Having no access controls is like leaving your cyber security front door ajar

4) Use secure settings for your devices and software

Most devices and software applications are supplied with default configurations that make getting started easy for the user. However, as above, leaving default settings can make it easier for cyber attackers to gain access to your data. Sharing user accounts and login credentials and having weak passwords also represents a significant risk.

Not using secure settings on devices and software is like leaving your cyber front door closed, but on the latch

5) Use a firewall to secure your internet connection

Do you have a firewall? Of course, you do! A larger organisation may have a bespoke firewall device, a smaller company or home worker will have a software firewall built into the hub or router provided by their ISP. But have you changed the default password on your firewall/router? No?

A misconfigured firewall is like leaving your cyber front door closed, but not locked

Cyber Essentials is not difficult!

So there you have it. There’s nothing scary involved and once you have achieved Cyber Essentials, not only are you likely to be more secure, you can also use it to open new opportunities and differentiate yourself from your competitors.

How much does Cyber Essentials cost?

The cost of the certification scheme is limited by the Government to just £300 (+ vat). The cost of Cyber Essentials Plus is from £1,620 (+ vat).

What should I do next?

If you need any help, feel free to contact the team at Securious, the South West’s leading cyber security company. They have provided the content on this site and are passionate about helping businesses and organisations understand and improve their cyber security.

If you have any questions, a member of the team would be more than happy to speak with you – just fill in the contact form below, or get in touch with them on 01392 241110, or info@securious.co.uk

Read more cyber security guides:

Supply chain compliance and cyber security accreditation for new business and procurement – ultimate UK guide

SIEM solutions and SOCs: a UK guide for better cyber security and compliance

PCI Compliance UK – ultimate guide

SIEM solutions and SOCs (Security Operations Centres) offer UK organisations the opportunity to improve their cyber security and compliance, with standards such as PCI DSS, ISO 27001 and Cyber Essentials. This guide explains what they are, how they work, and how they help keep UK organisations more secure.

SIEM solutions

What is a SIEM solution?

SIEM stands for Security Information and Event Management. A SIEM solution works by collecting logs from multiple devices across a network and amalgamating the data into a usable form. This includes identifying activity that is abnormal.

What does a SIEM solution do?

SIEM solutions enable the monitoring and analysis of data from a wide range of sources. They help you cut through the noise and make the data useful. For example, they can identify vulnerabilities and suspicious activity. SIEM solutions also keep a record of all activity in case forensic analysis is required.

How are SIEM solutions useful?

SIEM solutions help security teams (often described as a Security Operations Centre – see below) to identify and address vulnerabilities, as well as responding quickly to potential threats and accessing key information from the past for the purposes of forensic analysis – or to achieve compliance requirements more easily.

How do SIEM solutions work?

SIEM solutions undertake a number of key functions in order to deliver the information required by security teams.

1. Collect data. SIEM solutions use collection agents to collect log data from a variety of sources in the client environment. These may include devices, servers, firewalls and other equipment.
2. Store data. SIEM solutions store some or (for example in the case of Monikal) all log data. This enables extensive analysis and historical review where this is required.
3. Understand what is ‘normal’. SIEM solutions ‘learn’ their environment through a combination of data collection and added rules or policies. This means a user can tell the SIEM solution what normal would look like so it can identify and alert staff if something unusual takes place.
4. Consolidate and correlate. SIEM solutions are able to analyse a wide range of data from a large number of sources and make sense of it, including flagging the severity of potential incidents.

Examples of how SIEM solutions help improve cyber security and compliance

A SIEM solution could help you identify or respond to the following situations:

• A member of your team downloads your whole client database onto a USB stick
• Someone logs into your CEO’s email account from China and then, just five minutes later, your CEO logs in from London
• A junior member of your team escalates their privileges and gains access to confidential data
• An intruder within your systems changes a system event log in an attempt to cover their tracks
• Any of your systems are not correctly time synchronised – important for forensic analysis etc.
• Detection of attacks at system boundary (firewall etc.)
• Employees are attempting to visit blocked websites which may host malware etc.
• There is an increase in user account lockouts, indicating possible brute force authentication attacks
• There is an increase in successful authentication user sessions via remote access, this could be an indicator of possible insider threats etc.
• The status of backup activities, prolonged failures could impact disaster recovery readiness
• There is a change to protected asset access, changes could indicate malicious activity
• There are an excessive amount of out-of-hours remote access attempts, excessive attempts could be an early indicator of things such as industrial espionage
• Critical or high vulnerabilities exist on systems and have not yet been patched

Choosing a SIEM solution – why Monikal?

Monikal is the first SIEM solution designed in the UK specifically for the needs of mid-level organisations.

It is built on world-leading technology from Assuria – a supplier to enterprise-level organisations and governments around the world. So Monikal is right up there in terms of its technology. However, everything we have done in developing Monikal has been designed to meet the needs of mid-level and growing organisations. From the onboarding to the pricing to support, we understand businesses that might not traditionally have been in the market for an enterprise-level SIEM solution, but need and deserve the same benefits. Monikal is for those kinds of companies and organisations.

Benefits of the Monikal SIEM

Monikal has a number of significant benefits including:

• Ability to detect and respond to cyber threats
• Increased resilience to external and internal threats
• Identification of criminal or negligent behaviours
• Insight and intelligence about user behaviours
• Full recording of all network activities
• Regular cost-efficient vulnerability scanning
• Monitoring and reporting in line with PCI DSS requirements
• Reports on the 5 security controls required for Cyber Essentials Plus
• Forensic capabilities in the event of an incident
• Hosted in a Tier 1 UK data centre
• UK-based support

In addition to this, Monikal meets all the requirements recommended by the National Cyber Security Centre in the SIEM solution buying guide.

What is a SOC (Security Operations Centre)

A Security Operations Centre (or SOC) is a team responsible for security within an organisation. In this context, a SOC will be the team responsible for monitoring and responding to issues identified by the SIEM solution, which they will use to optimise the cyber security and compliance needs of the organisation.

How does a SOC work?

The way a SOC (Security Operations Centre) works will depend on the size and needs of a particular organisation. While an enterprise level organisation may have a full in-house team of specialist analysts, a smaller mid-level organisation may look to out-source the requirements of monitoring and responding to security incidents identified by a SIEM.

Examples of how a SOC can help cyber security and compliance

An effective SOC should mean a dedicated focus on an organisation’s security. For example:

• A SIEM might detect unusual login attempts and the SOC team will examine these. Then, they’ll identify if they are legitimate and, if not, can put in place additional procedures to minimise the likelihood of a breach
• A SIEM might show that certain devices – eg those of employees now working from home – have not had the latest software patches and as a result are now a security risk. The SOC team can then undertake these as a matter of urgency.
• A SIEM might show attempts to access the user account of an ex-employee – then the SOC team can investigate where these are coming from and ensure these and any related accounts from the same ex-employee are deactivated.
• A SIEM could be configured to show that an employee clicked on a malicious link in a phishing email. Despite safeguards being in place to prevent the download, the SOC team can address any training requirements to minimise the chances of this happening in future.
• A SIEM might show internal threat actors such as an employee who is logging onto their account and downloading data out of work hours. The SOC team can run reports to highlight this unusual activity and notify the client to investigate further.

Why the Securious Managed SOC solution is ideal for mid-level organisations?

Working in conjunction with our SIEM solution Monikal, Securious offers a managed SOC service especially tailored to smaller but ambitious and growing mid-level organisations in the UK.

Typically, these companies will have an IT director or CISO (chief information security officer). They may also have an in-house or managed IT service, but these will not be security specialists. Additionally, the senior personnel will not have the time available to monitor SIEM activity on a daily basis.

This is where the Securious Managed SOC service uniquely fills a gap. Securious will monitor the Monikal dashboard and respond to alerts of abnormal activity or vulnerabilities. They will notify the client when action is required with clear recommendations on what needs to be done.

The net result is a much more secure and compliant organisation. And this comes at a fraction of the spend of having a full-time in-house team.

What should I do next?

If you need any help, feel free to contact the team at Securious, the South West’s leading cyber security company. They have provided the content on this site and are passionate about helping businesses and organisations understand and improve their cyber security.

If you have any questions, a member of the team would be more than happy to speak with you – just fill in the contact form below, or get in touch with them on 01392 241110, or info@securious.co.uk

Click here to learn more about our managed SOC services

Click here to learn more about the Monikal SIEM solution

To achieve PCI compliance means to meet the standards of the Payment Card Industry Data Security Standard (PCI DSS). This standard contains a set of requirements designed to increase data security and protect merchants and customers when taking and making payments by debit or credit card.

The PCI Security Standards Council (PCI SSC) is a global forum that brings together payments industry stakeholders to develop and drive adoption of data security standards and resources for safe payments worldwide.

The Council was founded in 2006 by American Express, Discover, JCB International, MasterCard and Visa Inc.

The current standard is PCI DSS 3.2.1

Is PCI compliance necessary in the UK?

Yes!

All UK merchants and service providers that process, transmit or store payment card data must be PCI DSS compliant.

For merchants: if you accept payment by debit or credit card for goods or services, you must be PCI DSS compliant, even if you use a third-party organisation or platform to process the payment (see below).

For service providers: if you are involved in processing, storing or transmitting cardholder data on behalf of another party, you must be PCI DSS compliant.

Do I need PCI compliance if I use a payment provider like Stripe or SagePay?

Yes!

If you use a payment service provider, PCI compliance becomes a shared responsibility between yourself as the merchant and the payment provider.

Using a payment service provider will normally mean you, as the merchant, have no need to see or have any access to the card holder’s information. This makes it much easier to meet your PCI compliance requirements, but it does not remove them.

What could be the consequences of not being PCI compliant?

The main consequence of not being PCI compliant is that you may not be protecting cardholder data. This means you could be responsible for a breach and that could be enormously costly for your business and your customers.

A data breach could result in both financial and identity theft from your customers. This will need to be reported to the Information Commissioner (and your customers) and you could be liable to financial penalties that could be significant under the GDPR (General Data Protection Regulation), as well as the card brands.

In addition, your bank may set considerable (and costly) requirements for you to be able to continue accepting card payments after the breach. For example, if you have been subject to a cardholder data breach, you will be required to conduct a PCI council-approved forensic investigation and then achieve the highest level of compliance (Level 1 – see below) regardless of the number of payments you take.

Beyond these fines, the impact of a cardholder data breach on your reputation could be catastrophic.

Even in the absence of a breach, failure to be PCI DSS compliant means you are likely to be liable for fines and additional transaction charges from your bank. They may also withdraw the facility to take payment by credit and debit card if you continue to be non-compliant.

How much could I be fined if I am not PCI compliant?

If you continue failing to meet your PCI compliance requirements, in the worst circumstances your acquirer could withdraw your facoility for accepting payment cards.

You could also be subject to increased fees for every card payment you take. One company we recently engaged with was paying over £1,000 per month in non-compliance fees when the issue was resolvable with a one-off investment of around £3,000.

On top of this, you can incur fines costing as much as tens of thousands of pounds depending on the level of breach and cardholder data stolen.

What are the PCI compliance levels?

There are four levels of merchant based on the number and type of transactions they take. Level 1 concerns those merchants that take the highest number of transactions (or who have had a data breach previously) and Level 4 concerns those merchants who take the fewest number of card payments.

The specific criteria for each compliance level are:

Level 1

Merchants who process over 6 million payment card transactions a year (or those who have suffered a cardholder data breach in the past).

Level 2

Merchants processing between 1 million and 6 million payment card transactions a year.

Level 3

Merchants processing between 20,000 and 1 million payment card transactions a year.

Level 4

Merchants processing fewer than 20,000 payment card transactions a year.

See more from VISA and Mastercard.

What does it take to be PCI compliant?

PCI DSS compliance covers three main areas:

• Handling card data: ensuring card holder data is collected and transmitted securely
• Storing data securely: ensuring that if you store card data, the payment environment meets a series of specific requirements into terms of the technology, people and processes involved – see the 12 steps of PCI DSS below
• Annual validation: for all levels, an annual validation via form – an SAQ or Self Assessment Questionnaire – is required. However, the specific requirements depend on a number of factors and vary by level of merchant and acceptance channels (see below). In addition, any organisation that needs to be PCI DSS compliant may need to validate that to payment processors, suppliers or clients, and customers.

What are the 12 steps PCI DSS version 3.2.1?

These 12 steps are the main security controls or requirements for achieving PCI compliance, broken into six objectives:

Build and maintain a secure network and systems

1) Install and maintain a firewall configuration to protect cardholder data

2) Do not use vendor-supplied defaults for system passwords and other security parameters

Protect cardholder data

3) Protect stored cardholder data

4) Encrypt transmission of cardholder data across open or public networks

Maintain a vulnerability management programme

5) Protect all systems against malware and regularly update anti-virus software

6) Develop and maintain secure systems and applications

Implement strong access control measures

7) Restrict access to cardholder data by business need to know

8) Identify and authenticate access to system components

9) Restrict physical access to cardholder data

Regularly monitor and test networks

10) Track and monitor all access to network resources and cardholder data

11) Regularly test security systems and processes

Maintain an information security policy

12) Maintain a policy that addresses information security for all personnel

What are the PCI compliance validation requirements by level?

The different levels (see above) require a different set of validation procedures which can be summarised as follows:

Level 1

Annually

• File a ROC (Report on Compliance) by a Qualified Security Assessor (QSA – see below) or an internal assessor if signed by a company officer
• Submit an AOC (Attestation of Compliance) Form submitted

Quarterly

• Network scan conducted by an Approved Scan Vendor (ASV)

Level 2

Annually

• File a ROC (Report on Compliance) or SAQ (Self Assessment Questionnaire) by a Qualified Security Assessor (QSA – see below) or an internal assessor if signed by a company officer
• Submit an AOC (Attestation of Compliance)

Quarterly

• Network scan conducted by an Approved Scan Vendor (ASV)

Level 3

Annually

• Complete an SAQ (Self-Assessment Questionnaire – see below) signed by a company officer
• Submit an AOC (Attestation of Compliance)

Quarterly

• Network scan conducted by an Approved Scan Vendor (ASV

Level 4

Annually

• Complete an SAQ (Self-Assessment Questionnaire – see below) signed by a company officer
• Submit an AOC (Attestation of Compliance)

Quarterly

• Network scan conducted by an Approved Scan Vendor (ASV

What is an SAQ (Self Assessment Questionnaire)?

A Self-Assessment Questionnaire (SAQ) is a self-validation tool to assess security for cardholder data. It’s suitable for smaller merchants and service providers who are not required to submit a Report on Compliance.

The Self-Assessment Questionnaire includes a series of yes-or-no questions for the security requirements. If an answer is no, your organisation may need to specify what you will do to achieve the required level and by when.

There are a series of nine different SAQs available from the PCI Security Standards Council to meet different types of merchant and service provider requirements.

See more from the PCI Security Standards Council

What is a PCI QSA (Qualified Security Assessor)?

1. Qualified Security Assessor (QSA) companies are independent security organisations that have been qualified by the PCI Security Standards Council to validate an organisation’s compliance with PCI DSS.
2. QSA employees are individuals who are employed by a QSA Company and have satisfied and continue to satisfy all QSA Requirements.

Common PCI compliance myths

There are many myths and misunderstandings about PCI compliance. These are some we encounter on a regular basis:

MYTH – PCI compliance is only ‘a thing’ for big businesses.

If you’ve read this guide you will be clear that every merchant that takes payment by credit or debit card needs to be PCI DSS compliant and can face significant consequences if they aren’t.

MYTH – We use Sage Pay/Stripe/Paypal etc and they are fully PCI compliant so we don’t need to be.

As explained above in this guide, every merchant who takes payment by card needs to be PCI compliant. Using a payment provider like Sage Pay or Stripe or Paypal may make it much easier to achieve and demonstrate that you are PCI compliant, but it does not in any way make you exempt.

MYTH – I do not need to be PCI compliant because it is not a legal requirement.

This is not the case, but it is required by the payment card companies and banks. Failure to comply means they can both remove the option for a merchant to take credit card payments and charge them much more for doing so. Should an organisation face a breach of cardholder data and not be PCI DSS compliant, the penalties are likely to be more severe.

MYTH – I can just answer ‘Yes’ to all the questions on the Self-assessment Questionnaire (SAQ).

This is an extremely dangerous position to take because the SAQ has to be signed by an officer of the company. If they answer ‘Yes’ to a question when they aren’t adequately meeting that control, the banks and payment card companies will take that very seriously. If a card data breach occurs and it becomes clear the merchant was never actually compliant, the consequences for the organisation could be extremely serious.

MYTH – I never committed to being PCI compliant and I can wait until the bank asks me to.

This is a common misunderstanding and another very dangerous one. The terms signed when a merchant opens a bank account will state that PCI compliance is required and you will not be allowed to operate a merchant account if you are not PCI compliant.

How much does it cost to achieve PCI compliance?

The cost of PCI engagement will depend on scope which includes a number of different scenarios. For example: number of transactions, type of transactions (e.g. face to face, ecommerce), payment environment and so on.

It will also depend on where you are and how much work is needed to meet the appropriate compliance levels.

How can Securious help me get or maintain PCI compliance?

Securious has been a PCI QSA company since 2016 and has two fully qualified and highly experienced PCI QSAs.

We are based in Exeter, Devon but undertake PCI QSA work nationally and internationally.

Our mission is to build cyber security confidence and when it comes to PCI DSS compliance, we will work with you to make the process as efficient as possible, helping you understand what you need to do, and why.

Typically, we approach PCI QSA engagements as follows:

• We start by assessing your situation to determine the scope and what level you need to be reporting at. Then, we conduct a gap analysis, looking at what you already have in place against the requirements, so we can determine the additional measures you need to implement to achieve compliance.
• We will then advise and assist with any remediation work needed to meet the standard.
• Finally, we will carry out your assessment and complete the necessary reports and questionnaires as required.

What should I do next?

If you need any help, feel free to contact the team at Securious, the South West’s leading cyber security company. They have provided the content on this site and are passionate about helping businesses and organisations understand and improve their cyber security.

If you have any questions, a member of the team would be more than happy to speak with you – just fill in the contact form below, or get in touch with them on 01392 241110, or info@securious.co.uk