PCI Security Audit Procedures V1 0 Visa Public 2

Payment Card Industry Security Audit Procedures „„ Payment Card Industry Security Audit Procedures This document is to be used by those merchants and service providers who require an onsite review to validate compliance with the Payment Card Industry (PCI) Data Security Standard and to create the Report on Compliance. Note that these PCI Data Security Requirements apply to all Members, merchants, and service providers that store, process or transmit cardholder data. Additionally, these security requirements apply to all “system components” which is defined as any network component, server, or application included in, or connected to, the cardholder data environment. Network components, include, but are not limited to, firewalls, switches, routers, wireless access points, network appliances, and other security appliances. Servers include, but are not limited to, web, database, authentication, DNS, mail, proxy, and NTP. Applications include all purchased and custom applications, including both internal and external (web) applications. Scope of the Assessment For service providers required to undergo an annual onsite review, compliance validation must be performed on all system components where cardholder data is processed, stored, or transmitted, unless otherwise specified. For merchants required to undergo an annual onsite review, the scope of compliance validation is focused on any system(s) or system component(s) related to authorization and ...