PCI DSS Foundation: Understanding the Payment Card Data Security Standard

Module 1: understanding the PCI DSS standard and ecosystem

• The context and benefits of PCI DSS compliance.
• Electronic payment roles and stakeholders: merchants, acquirers and issuers.
• The payment flow and electronic payment process.
• Payment fraud and risks.
• The PCI Security Standards Council (PCI SSC) and other standards it publishes: PCI PTS and PCI P2PE.
• The history and objectives of PCI DSS.
• The pillars of information security: confidentiality, integrity and availability.
• The relationship between PCI DSS and other standards such as ISO 27001 and ISO 27002.
• Payment card data: distinguishing confidential data from sensitive data.
• Merchant types, self-assessment questionnaires (SAQs) and compliance documentation (AOC and ROC).
• Applicability and scope of the standard: organisational and technical.

Practical exercises

• Identify the scope and applicable SAQ type for a given case.

Module 2: understanding the standard's 6 domains and 12 requirements

• Domain 1: build and maintain a secure network and systems
  • installing and maintaining network security controls (requirement 1);
  • applying secure configurations to all system components (requirement 2).
• Domain 2: protect account data
  • protecting stored card data (requirement 3);
  • protecting data with strong cryptography during transmission over open, public networks (requirement 4).
• Domain 3: maintain a vulnerability management programme
  • protecting all systems and networks from malicious software (requirement 5);
  • developing and maintaining secure systems and software (requirement 6).
• Domain 4: implement strong access control measures
  • restricting access to system components and data according to business need (requirement 7);
  • identifying users and authenticating access (requirement 8);
  • restricting physical access to cardholder data (requirement 9).
• Domain 5: regularly monitor and test networks
  • logging and monitoring all access to system components (requirement 10);
  • regularly testing system and network security (requirement 11).
• Domain 6: maintain an information security policy
  • supporting information security through organisational policies and programmes (requirement 12).
• Overview of the standard's appendices.

Case study

• Analyse real-world risk and threat scenarios affecting payment systems.

Module 3: mastering the compliance process and documentation

• The role of Qualified Security Assessors (QSAs) and Internal Security Assessors (ISAs) in the annual assessment process.
• The PCI DSS project: nature, challenges, governance, roles and responsibilities, success factors, plan, scope, technologies and required documentation.
• Actions to avoid in a compliance project.
• The certification pathway and associated practical advice.
• New features of PCI DSS v4 and comparison with version 3.2.1.
• Introduction to document templates: gap analysis, information security policy, incident response plan and flow diagrams.

Case study

• Analyse document templates and develop a compliance action plan.

Module 4: preparing for the PCI DSS Foundation exam

• In-depth review of the key concepts covered across all modules.
• Official PCI SSC documents and methodological guidance for reading them.
• Strategies to maximise your chances of exam success.

Practical exercises

• Complete a practice quiz to validate your learning before taking the official exam.