Phase 1 - Information Gathering and Merchant Segmentation and
Prioritization
- Collect all available merchant data in-house and with 3rd party
vendors (i.e. PED support data)
- Collate all information
- Categorize merchants into PCI segmentation levels based on whether
they simply transmit card data (segmentation level Type 3) or retain card
data (segmentation level Type 5)
- Prioritize the merchants based on transaction volumes and customer
profile.
Phase 2 - Acquirer Merchant Support Representative Education and
Training
- Educate Acquirer support staff on PCI DSS to ensure that all account
managers and merchant support representatives are fully aware of the
program.
- Train support representatives on the SAQ process in order to assist
merchants with questions and SAQ compliance maintenance.
Phase 3 - Merchant Awareness & Education
- Establish a Merchant awareness program for all merchants that will
include monthly flyers, SMS broadcasts, and on-site reviews to ensure that
all merchants are aware of their PCI requirements and can complete the SAQ
appropriately.
- Conduct a training program, which will include an introduction to the
PCI standards, for Type 5 Merchants.
Phase 4 - SAQ Completion Program
- Merchant SAQ compliance will be a combination of phone assisted
interviews and on-site interviews and assessments.
- Merchant compliance status will be managed through an online portal
that will provide an SAQ repository, collated status and reporting
functionality.
- Type 3 Merchant interviews will be scheduled merchants contacted via
telephone and assisted with completion of the SAQ B as per the compliance
requirements
- Type 3 Merchants that do not complete the SAQ via telephone will be
contacted on a site visit to complete the SAQ B in an interview process.
- Type 5 Merchants that will require a full assessment and vulnerability
scan as per SAQ D will be contacted on site visits for the initial
assessment and follow-up assessment completion if required.
Phase 5 – Tracking, Reporting & Network Scans
- Monitor SAQ progress for Merchants
- Report on Merchant Compliance for regulators and card schemes
- Conduct initial external network scans for all merchants who require
scans.
Phase 6 – Remediation Plan and Assistance
- For all merchants that are non-compliant, Versos can track a separate
remediation ticket on the portal for each action that requires
remediation.
- For all merchants that are non-compliant, Versos can provide periodic
follow-up to close gaps and as needed remote support on an hourly fee
basis
Versos also offers the following PCI Services
Internal PCI DSS Compliance
Programme
Payment Application Compliance
(PA DSS) |
