Payment Card industry Data Security standard Consulting Services
(PCI DSS) Readiness, Implementation, VAPT, Audit and Program Management

Phase I - Scoping

Scoping involves:

• Understanding the business and the Cardholder Data Environment (CDE)
• Mapping Data Flows
• Network Segmentation Readiness
• Systems in Scope
• Applicable and Not applicable list of controls

Phase II - Gap Analysis and Risk Assessment

Based on the outcome of phase I, a combination of approaches is applied by Coral PCI DSS consultants to conduct the gap analysis.

• Assessing strengths and weaknesses of the applicable requirements
• System-wise control and configuration checks
• identify and report system weakness along with detailed recommendations

Phase III - Implementation Support

In this phase, Coral PCI DSS Consultants assist clients in the implementation of the following:

• Optimization of current configurations such as access, change and patch management requirements
• Implementation of tools that are identified as gaps
• Documentation involves sharing and discussing 20+ policies and procedures across domains involving PCI DSS governance starting with asset identification
• Risks identified in the gap analysis are tracked toward decision-making and closure. Some risks are quick wins, whereas others may take longer to close. - If the gaps are more, this phase can be longer

Phase IV - Internal Audit and Management Review

• In this phase, Coral PCI DSS Consultants will provide an independent opinion about the successful implementation, with additional recommendations if any.
• Internal Audit involves verifying the effectiveness of the implemented lifecycle controls through interviews with system verification of applicable controls,
• A formal report is published for the management team.
• We facilitate reviews with the management to ensure that the initial PCI DSS control objectives and goals are achieved.

Summary

At this stage:

• As a result of undergoing these phases, Coral has assisted the client in fulfilling all applicable requirements for PCI DSS.
• Each of the PCI DSS certification requirements has been completed by a combination of one or more configuration, tools, policies, responsibilities, reports, records, technology, and automation.
• The organization now has a plan that demonstrates its continued commitment like any other business function
• At this stage, the organization is ready to invite external QSA to certify them to PCI DSS certification

Phase V - PCI DSS QSA Support

The chosen QSA will perform PCI DSS certification in two phases:

• Stage 1- Interviews
• Stage 2 – Documentation Review, and
• Stage 3 - Configuration Reviews

With the above phases completed, the QSA issues the PCI DSS attestation report.

Phase VI - Successful Certification

At this stage you have received successful QSA compliance on PCI DSS.