The document outlines the process for building PCI compliance. It discusses performing a preliminary assessment to identify non-compliance, developing recommendations for remediation, implementing changes to payment infrastructure, documenting information security management processes, performing mandatory checks, and conducting a certification assessment to validate compliance. It also describes optimal processes for small and large payment infrastructures, involving a QSA consultant and possibly a systems integrator. The key steps are a preliminary assessment, developing remediation recommendations, implementing changes, documenting processes, mandatory checks, and a final certification assessment.

1. Building PCI Compliance: organizing the process Sergey Shustikov Digital Security Head of information security governance direction, CISA, PCI QSA April 20, 2010

4. © 2002— 2010, Digital Security Cast 4 Building PCI Compliance: organizing the process Client QSA-consultant System integrator

9. © 2002— 2010, Digital Security Documentation 9 Building PCI Compliance: organizing the process Preliminary assessment Development of recommendations Development of technical project Implementation of changes Documenting of ISMS processes Mandatory checks Certification assessment Submission resultant report to Payment Brand or acquirer ROC- ROC- Remediation recommendations Remediation recommendations Technical project Acceptance report ASV report Pentest report ROC+ AOC ISMS documentation Action Plan