An ongoing requirement of the PCI compliance process involves having your payment card environment scanned for security vulnerabilities. For most businesses, PCI scanning must be conducted by an Approved Scanning Vendor (ASV) at least quarterly, as well as following any major change to your environment. … Read more
So, you have been notified by a client, card brand, or your acquiring bank that you have to engage a third-party QSA company to perform a QSA-led PCI DSS assessment. There are some things that you need to know, or need to consider before moving … Read more
What’s new at the PCI Council? The PCI Council has come out with their long-awaited changes to the Qualified Integrators & Resellers (QIR) program. The PCI QIR program was launched in 2012 to ensure that payment systems integrators and resellers know how to support a … Read more
High-risk payment acceptance is everywhere. A recent payment experience at my local dry cleaners caused me some alarm, so much so that I described it in detail on LinkedIn: Without any real forethought I pulled out my debit card. Maybe it was the knowledge that … Read more
“Why am I being asked to whitelist ControlScan’s IP address as part of your ASV service? Doesn’t bypassing my IPS defeat the purpose of a PCI vulnerability scan?” ASV whitelisting is one of the most common questions our Vulnerability Management team receives, so let’s dive … Read more
How do you conduct your IT risk assessments? In a recent ControlScan customer survey, we asked IT leaders about risk assessments. Specifically, we wanted to know how often businesses are conducting them, as well as if they are doing so formally by using an external … Read more