Payment card information remains one of the most targeted forms of data. For Australian organisations that store, process or transmit cardholder data, PCI DSS compliance is essential — not simply as an annual requirement, but as a way to reduce risk and improve the security of systems that support payment operations.
DotSec has more than 25 years of experience securing payment environments for government, APRA-regulated entities, financial institutions, utilities and national retail organisations. We focus on what PCI DSS was designed to achieve: practical, risk-driven improvements that reduce the likelihood and impact of compromise, not superficial checkbox activity.
PCI DSS (the Payment Card Industry Data Security Standard) is a set of technical and operational requirements designed to protect cardholder data. Compliance means implementing, operating and maintaining a comprehensive set of controls relating to:
Network segmentation and security
Access control and authentication
Logging, monitoring and incident response
Secure software development
Vulnerability management
Physical security and hosted environments
Supplier and service-provider oversight
PCI DSS compliance applies to any organisation that touches payment card data, even indirectly. That includes retailers, e-commerce sites, service providers, franchise networks, billing platforms, hospitality groups and SaaS platforms that integrate payment processing.
You (well, really, your business) will almost certainly need to be PCI DSS compliant if you:
Accept credit or debit cards (online or in-store)
Use a payment gateway or merchant provider
Store or transmit cardholder data (even temporarily)
Develop or host systems involved in payment processing
Are a managed service provider to organisations who themselves process cardholder data
PCI DSS compliance is not optional in Australia, and it is often expected by banks, acquirers, insurers and partners, as well as sometimes being required by due-diligence processes.
Generally speaking, all merchants have reporting requirements, irrespective of their level. However, the specific requirements differ: Most merchants, except for the highest level (Level 1), are typically required to complete a Self-Assessment Questionnaire (SAQ). Level 1 merchants, on the other hand, usually need to undergo an annual assessment by a Qualified Security Assessor (QSA).
For the bulk of merchants, the key to PCI DSS compliance is the Self-Assessment Questionnaire (SAQ).
Different SAQs exist, each tailored to different types of payment processing environments. The specific SAQ a merchant needs to complete depends on how they process card payments.
SAQ A (Self-Assessment Questionnaire A) is the leanest of the PCI DSS reporting paths, meaning that it can be used (in general) with very little effort or time.
Merchants prefer SAQ A because there are only 26 controls (and some of those might be non-applicable) and it’s often possible for the merchant to offload many of it’s PCI DSS responsibilities to third-party providers such as payment gateways or security service providers, as long as those third parties are themselves PCI DSS compliant.
To be eligible for SAQ A, all cardholder data functions must be fully outsourced to PCI DSS-compliant TSPs, and merchants must:
Tier 1 merchants and service providers, or those merchants/service-providers who have particular acquirer requirements, will need to report using a Report On Compliance (ROC).
In this scenario, DotSec’s Qualified Security Assessor (QSA) will formally assess how effectively client meets the applicable requirements from the PCI DSS.
In contrast to the collaborative nature of a scoping or gap-analysis project, the QSA-led PCI DSS assessment will be a formal assessment process, the outcomes of which are documented in a formal Report on Compliance (ROC):
It is important to note that the formal QSA-led assessment must be conducted in a timely manner. As a QSA Company, dotSec would ensure that the client remains aware of the assessment timetable, impending deadlines and project completion date.
dotSec stands out among other PCI DSS companies in Australia for a couple of important reasons:
If you need to report under the PCI DSS, either using a SAQ or as part of a QSA-led assessment, DotSec is here to help. Our team of experienced professionals can guide you through the entire process, helping you to reduce scope and reporting costs wherever possible. Doesn’t saving you cost reduce our income? Why yes, for one job it does! But if we can cut the costs you’ve been paying to your incumbent QSA company, you’ll be happier and that’s the recipe for the kind of long-term relationship that we value above all else.
Ensuring compliance with the PCI DSS has the potential to be risky, painful and expensive experience, but with a dotSec QSA by your side, your journey becomes a lot easier.
