October 2, 2019, Dublin, Ireland – Atlanta, Georgia – London, United Kingdom – Sysnet Global Solutions has announced the launch of its PCI DSS solution designed to help payment facilitators, their sub-merchants, and their Acquirers increase PCI compliance and reduce risk. The PCI DSS (Payment Card Industry Data Security Standard) is a set of […]
Mastercard has set a deadline for acquiring organisations to manage risk in their Level 4 Merchant portfolio. Mastercard’s updated Site Data Protection (SDP) Program rules expect PCI DSS compliance validation from your high-risk merchants. Mastercard requires all acquirers to have a Level 4 risk management programme in place to meet the updated SDP requirements. […]
by Michael Hopewell, Managing Information Security Consultant. Introduction Many businesses have heard about Point to Point Encryption (P2PE). Point of Sale vendors, service providers and others often mention its benefits to businesses: P2PE can reduce risk to payment card data by rendering it unreadable, minimise the number of systems and networks in scope for […]
Compliance with the PCI DSS (Payment Card Industry Data Security Standard) is mandatory for all businesses accepting cards for payment. The Standard ensures appropriate security protocols are applied to your payment acceptance environment to protect against fraud. In its simplest form, the process of achieving compliance involves a scoping (or profiling) stage, which determines […]
Lots of Internet-connected devices are available on the market and a popular theme now is devices to create a ‘smart home’, which includes smart door locks, surveillance/security cameras and heating control systems that can be monitored and controlled when you are away from the home. This ability to remotely connect to and integrate devices […]
The 25th of May has come and gone. While many organisations were proactive in their preparations for aligning themselves with the GDPR, sadly many of your customers may still be the dark about the GDPR and what it means for them. The effects of the GDPR are coming, but should they still be worried? […]
On the 17th May 2018, the PCI SSC published the latest version of the PCI Data Security Standard: the PCI DSS v3.2.1. In this article we look at the changes that have been included in the updated Standard. These are also discussed in the PCI SSC’s summary of changes document. A new standard? This […]
Over the last few months, the PCI SSC has published a set of documents to establish a new program for the specification, testing, evaluation and PCI SSC listing of Software-based PIN entry on Commercial Off The Shelf devices (COTS) Solutions. Solutions also known as SPoC. The PCI DSS developed this new PCI Security Standard […]
‘PIN on Glass’ is a catchy phrase that the payments industry and solution vendors have been bandying about as the next big thing for payment card processing: point of sale solutions that will allow merchants to accept card payments using just their mobile device and with no need to purchase expensive hardware. This is […]
JUMP TO THE INFOGRAPHICS RELATED TO THIS BLOG POST >>> We see and hear many articles in the media about data breaches and talk of millions of records being stolen by faceless cybercriminals. But once this data is stolen and obtained by the individual or criminal organisation, what do they do with […]
Compliance with multiple information security related standards and regulations can be challenging for organisations. However, by aligning all standards using our Combined Assessment Model, requirements, cost and complexity can be significantly reduced. In this infographic, we explore the short and long term benefits.
by Natasja Bolton, Senior Acquirer Support QSA The UK Cards Association’s 2017 report on UK Card Payments, released on 19th June 2017, reported a doubling of debit and credit card purchases in the last 10 years. The volume of card transactions reached 16.4 billion in 2016, an increase of 146% from 2006, even though the […]
by Natasja Bolton, Senior Acquirer Support QSA At the release of the PCI Scoping Guidance back in December 2016, the PCI Council highlighted the fact that “data breach investigation reports continue to find that companies suffering compromises were unaware that cardholder data was present on their compromised systems”. Why is that? Well, often […]
Online commerce has created incredible new opportunities for businesses to market and sell services globally. Many businesses, in particular small to medium ones, often do not consider that they could be targeted by cyber crime. The reality, unfortunately is that small to medium businesses are now very much being targeted by cyber criminals as many are […]
Information Security is complex. Understanding risk and implementing appropriate mitigating controls, be they technical or otherwise, is a challenge for organisations of any size. There is no getting away from that, but witchcraft?
Conducting an outreach campaign can be tricky to get right as well as resource heavy. Responding to market conditions while also proactively engaging your customers through their preferred channels can be difficult to achieve successfully. It can make sense to outsource, however often providers are not specialised or experienced enough in conducting an outreach security and compliance […]
In a previous article, written by Sysnet’s Paul Prior, Paul mentioned how he believed that a change was necessary in the industry. A move away from using non-compliance fees as a mechanism to drive engagement and compliance. He highlighted that most of Sysnet’s clients are evangelising the importance of PCI DSS, however not […]
Non-compliance fees are viewed by many as an acceptable short-term solution to a merchant’s unwillingness to engage with a compliance program. However, often despite the best efforts by acquirers, some merchants continue to remain disengaged. So when a merchant ignores notifications regarding their non-compliance status and the application of non-compliance fees, it may be […]
Money can buy many things, however relationships is a trickier one. It involves behavioural traits that can’t always be easily defined and controlled. However the reality is that customer relationships are a key component of what drives business. Many organisations can get caught up in the detail of their products and services. Neglecting to […]
Security and compliance is a lot like having to do taxes, it’s a chore. Most businesses understand that it is important to be secure and compliant, but the complexity and time that it can take can indeed be off putting. In fact some businesses turn to accountants to look after their compliance with standards such […]
By Jason McWhirr, Information Security Consultant It will come as no surprise that the Report on Compliance (RoC) template has also been updated as part of the roll out of Payment Card Industry Data Security Standard (PCI DSS) version 3.2. For those not so familiar with the template, it applies to all level 1 […]
By Natasja Bolton, Senior Acquirer Support In 2015 use of the 20 year old SSL security protocol for encryption of sensitive data in transmission was deprecated (in PCI DSS v3.1) to encourage ecommerce businesses to migrate to TLS (Transport Layer Security). In 2016, further technology changes are underway that will impact those of your customers […]
‘Ask a QSA’ has received the below question that we feel will resonate with some of our clients. Seasoned QSA, Natasja Bolton stepped up to the challenge. One of our merchants has provided their Attestation of Compliance (AOC) as a Service Provider, can we accept that AOC as covering their merchant compliance too? […]
Natasja Bolton, Senior Acquirer Support, investigates We previously wrote about the release of PCI P2PE Version 2 and its impact for acquirers and their merchants. In this follow-up article we explore an issue that has come to Sysnet’s attention: that many terminal solution providers and point-of-sale (POS) vendors appear to be actively avoiding P2PE […]
By Jason McWhirr, Information Security Consultant The likelihood that your customers will experience a data breach at some stage is unfortunately now a fact of life. It’s not if it will happen, it’s when will it happen? In the previous article, Ransomware – Did you update your incident response plan? we discussed how […]
We all know that security and compliance can be complicated for businesses. There are so many components for your customers to consider and manage. Businesses, in particular, small to medium ones often just want the pain to be taken away. The bottom line is that over the years when it comes to securely accepting payment […]
By Natasja Bolton, Senior Acquirer Support In order to assist you with navigating the updated standard we’ve prepared the following easy to reference Guide to PCI DSS v3.2. For a more in-depth review of PCI V3.2 we recommend reading the article PCI DSS v3.2 – What’s changed. Guide to PCI DSS v3.2 Key Dates […]
By Natasja Bolton, Senior Acquirer Support On the 28th April 2016, the PCI SSC published the latest version of the PCI Data Security Standard: the PCI DSS v3.2. We previously wrote about the changes that the council had planned for v3.2, in this follow-up article we examine the changes that have been included in the […]
“[Unfamiliar acronyms] create false economies. They may save a few words, but they may also frustrate and force the reader to take more time and effort to understand the document.” U.S. Securities and Exchange Commission, Plain English Handbook. Most sectors have their own industry jargon and acronyms, familiar to those working within the industry […]
The updated PCI DSS version 3.2 is scheduled to be released at the end of April, in our previous post entitled ‘Council announce PCI DSS V3.2 update’ we looked at what was potentially making an appearance in the update. In this follow-up article, we examine the planned features to the new update that were presented by […]
Increasing and maintaining PCI DSS compliance can be a challenge, many factors often come into play, from how customers are engaging with their PCI programme to what channel and communications are compelling them to take action. Every communication channel has a value and a benefit, understanding when to implement which channel and at what stage […]
Managing your database of customers across all PCI DSS levels can be challenging and may involve multiple spreadsheets, documents and email accounts scattered across your business. Engaging your relationship managed customers and guiding them through their PCI DSS journey can be complicated and challenging to keep track of. Sysnet’s VIP Manager addresses these issues […]
By Natasja Bolton, Acquirer Support Manager Although PCI DSS is a prescriptive set of requirements focussed on payment card data and most cyber-security guides do not go to the same level of detail, being high-level recommendations and advice without specific measures of the achievement of the risk reduction objective, the Cyber Essentials Scheme does cover a […]
by Dr. Grigorios Fragkos, VP Cybersecurity Ransomware, a malware that prevents or in some cases limits users from accessing their data has been on the rise. Last year, 2015 saw a considerable increase with Crowti (also known as CryptoWall) and FakeBSOD being the two instances that affected more than 850,000 systems between June and November. […]
According to a recent announcement, Visa will now require 100% of level 4 merchants in the US and Canada to have validated their PCI DSS compliance annually starting January 31st 2017. Whilst it has always been necessary for level 4 merchants to be compliant, these new rules will ensure that a consistent level of card […]
Every engagement with a client provides an opportunity for you to strengthen your relationship with them. By ensuring that each contact makes them feel that they have a strong business partner that they can trust, rely on, and build their business with, you are fueling their loyalty and strengthening your customer relationship. Conversely, each […]
Many factors can impact the effective delivery of a PCI programme for acquirers, processors and ISOs. From how customers are engaging with their PCI programme to what channel and communications are compelling them to take action. Download our Best Practice Guide where we take a look at how an omni-channel approach can improve customer […]
by Natasja Bolton, Acquirer Support Manager Business customers engage with all manner of third party service providers to support their business, whether that be IT support providers, data centres, offsite storage providers, hosting providers or payment processors. What is not always understood is that outsourcing a business operation or buying in a service […]
by Natasja Bolton, Acquirer Support Manager Most small and medium-sized merchants rely on an online compliance portal, such as our Sysnet.air solution, to determine the appropriate SAQ for their PCI DSS self-assessment. SAQ determination is based on the merchant’s completion of a series of questions on their payment channels and payment processing methods. For many merchants […]
In our experience, getting merchants compliant is not unlike carrying out a sales campaign, it can sometimes take quite a few calls to successfully engage merchants in the process. Studies show that 80 Percent of successful sales require five follow-up calls. Though it seldom takes that many calls to get merchants compliant, sometimes a […]
