Filling out the SAQ

I’ve heard so many variations on what it means to fill out the self-assessment questionnaire (SAQ) that I wanted to provide some clarification. First off, filling out the SAQ (regardless of which type) does NOT make you PCI compliant. You check boxes on the SAQ and that actually means something. It means that you are attesting to the fact that you are doing the necessary things to be in line with the PCI DSS, and can prove it when asked.

Many people think that simply because they only have a certain number of questions to answer, that only those items of the standard apply to them. The bottom line is this – every merchant that accepts credit cards is required to be compliant with the PCI DSS. The entire standard. For those of you that have fewer than 201 questions on your SAQ, you still must be compliant with the entire standard.

The Standards apply to all organizations that store, process, or transmit credit card data. If you’re unsure whether or not you are compliant, call us here at HALOCK Security Labs and ask for some help – that’s why we’re here!

PCI DSS Requirements

PCI DSS Requirement 5.4.1: Anti-spoofing controls such as DMARC, which stands for Domain-based Message Authentication, Reporting and Conformance, Sender Policy Framework (SPF), and Domain Keys Identified Mail (DKIM) can help stop phishers from spoofing the entity’s domain and impersonating personnel.

Clarification on eCommerce Outsourcing PCI DSS requirements 6.4.3 and 11.6.1

Unpacking the New PCI DSS Password Standards

Is Your Organization Prepared for PCI DSS Automation – Requirement 10.4.1.1?

What is the PCI DSS v4 Authenticated Scanning Mandate – Requirement 11.3.1.2?

What is the PCI DSS v4.0.1 Requirement for PoLP – Requirement 7.2.5?

PCI SSC Updates SAQ A: Removal of Key eCommerce Security and New Eligibility Criteria – Requirements 6.4.3, 11.6.1, 12.3.1

The New PCI DSS v4.0.1 Software Catalog Mandate – Requirement 6.3.2

How PCI DSS 4.0.1 Tackles Service Account Vulnerabilities – Requirements 8.6.1, 7.2.5.1, 8.6.2, 8.6.3, 10.2.1.2

Are You Keeping an Inventory of Cipher Suites and Certificates for the New PCI DSS – Requirements 12.3.3, 4.2.1.1?

How to Analyze An Attestation of Compliance (AOC)

PCI Compliance New Requirements and Targeted Risk Analysis (TRA)