PCI Policy Review Services

A PCI policy review looks at your company’s policies and procedures for payment card security and checks how they measure up to the relevant PCI DSS requirements.

PCI DSS Requirement 12 addresses information security policies and related security responsibilities. PCI SSC guidance explains that an information security policy should govern and direct the protection of information assets, and that the policy should remain current.

A policy review includes more than just proofreading your documents.

Tanner Security evaluates whether your policies:

• Conform to your actual technology environment.
• Address applicable PCI DSS requirements.
• Clearly define security responsibilities.
• Provide employees and other personnel with practical direction.
• Reflect significant changes to your systems, payment environment, and security practices.
• Support the evidence your company may need during a PCI assessment.

The goal is simple:

Your policies should guide your team, make responsibilities clear, and show how your business protects payment card data.

Many businesses write their policies once and only update them when an assessment is due.

This can lead to problems.

Your technology changes. Employees change. Vendors change. Payment processors change. Remote access changes. Cloud services change. Security responsibilities change.

Your policies should keep up with these changes.

Problems can also arise when a policy claims your company does something for security, but in reality, no one follows through.

For example, a policy may require quarterly access reviews even though your IT team performs those reviews annually.

A policy may prohibit storing payment card data while a business process continues to place that data in an internal system.

A policy may assign incident-response responsibilities to an employee who no longer holds that role.

These gaps can lead to compliance and operational risks.

A thorough PCI policy review can catch these issues before they become bigger problems.

PCI DSS Requirement 12 covers information security policies and programs that support payment card security. PCI SSC’s assessment materials emphasize that the information security policy should remain known and current and should provide direction for protecting information assets.

The exact requirements that affect your policies depend on your company’s PCI scope and applicable assessment method.

A comprehensive policy program may address information security governance, acceptable use, access management, authentication, remote access, security awareness, incident response, vulnerability management, change management, third-party service providers, data retention, and other areas relevant to your payment environment.

Tanner Security reviews the policies that matter most to your business, rather than using a one-size-fits-all approach.

A PCI policy review looks at both the content of your policies and how well they match your actual security controls.

Policy Completeness: We determine whether your documentation addresses the PCI requirements relevant to your environment and if important security responsibilities remain undocumented.

Accuracy: We compare your policies with the way your company operates. Your policy should not say your team does something if they do not actually do it.

Roles and Responsibilities: Policies should clearly explain who owns security responsibilities and what employees, contractors, administrators, managers, and other relevant personnel need to do.

Technical and Operational Alignment: Your policies should reflect your actual technology environment. A policy written for an on-premises environment may not accurately describe a company that now relies heavily on cloud infrastructure, remote workers, SaaS applications, or outsourced payment services.

Review and Maintenance: Your policies should have a clear process for reviewing and updating them when major changes affect your company’s security.

Evidence and Accountability: A good policy program helps your company show that security processes are in place and that responsibilities are clearly assigned.

Not every business needs a completely new policy program.

In many cases, existing policies provide a solid foundation and only need targeted updates.

A policy review can highlight where your company needs to update language, clarify responsibilities, remove outdated requirements, add missing sections, or create new procedures.

This approach can save time and help you avoid having a lot of policies that no one reads or uses.

Tanner Security’s goal is to create policies that are truly useful, not just add more paperwork.

Tanner Security can review your current PCI policy program or help you create and improve the policies you need.

PCI Information Security Policy Review: We review your overarching information security policy to determine whether it clearly directs the protection of payment-related systems and information.

Acceptable Use Policy Review: We evaluate whether your acceptable-use requirements clearly address the technologies and activities relevant to your business.

Access Control Policy Review: We examine whether your policies properly address access provisioning, privilege management, account reviews, authentication, and access responsibilities.

Incident Response Policy Review: We evaluate whether your incident-response documentation clearly defines responsibilities, escalation, communication, and response expectations for security incidents that could affect payment information.

Vulnerability Management Policy Review: We review policies governing vulnerability identification, remediation, scanning, patching, exception handling, and related security processes.

Third-Party Security Policy Review: Your payment environment may depend on payment processors, cloud providers, managed service providers, software vendors, and other third parties. We review policies that govern third-party security responsibilities and oversight.

Security Awareness Policy Review: We evaluate whether policies clearly establish employee security responsibilities and support the training and awareness activities applicable to your environment.

Data Retention and Disposal Policy Review: We review whether your policies clearly explain how your company retains, protects, and securely disposes of payment-related information in accordance with applicable requirements.

PCI 4.0 Consulting: We provide expert guidance on navigating the new requirements and changes introduced in PCI DSS 4.0. Our consultants help you understand and implement these updates to ensure continued compliance and security.

PCI Policy Consulting: Our team assists in developing and updating PCI policies and procedures that align with the latest PCI DSS standards, ensuring your organization adheres to best practices for protecting payment card data.

PCI CDE Penetration Testing: We conduct thorough penetration tests on your Cardholder Data Environment (CDE) to identify vulnerabilities and provide actionable recommendations for enhancing your security posture.

PCI DSS Compliance Assessments: Our compliance assessments evaluate your current state against PCI DSS requirements, identifying gaps and providing a roadmap for full compliance.

PCI Gap Assessment: We perform detailed gap assessments to pinpoint areas where your organization falls short of PCI DSS standards and offer strategies for effectively bridging these gaps.

Tanner Security has over twenty years of experience in cybersecurity consulting for PCI policy and compliance projects.

Our consultants also perform penetration testing, vulnerability assessments, IT audits, IT risk assessments, network security reviews, and PCI compliance assessments.

This broad technical experience allows us to review policies from a practical perspective.

We understand the challenges that arise when a written requirement does not match your technology or business process.

We also know that good security policies should support the people who use them daily.

Our advice focuses on making policies clear, accountable, secure, and practical, rather than adding unnecessary paperwork.

PCI policy work often ties into other security and compliance services.

Network Vulnerability Assessment: Identify known vulnerabilities across systems and infrastructure that support or connect to your payment environment.

Network Penetration Testing: Evaluate whether attackers can exploit weaknesses and move through internal or external network systems.

Web Application Penetration Testing: Test applications and APIs for authentication, authorization, business logic, session management, input validation, and other application-security weaknesses.

IT Policy Development: Develop broader information-security policies that support PCI DSS and your company’s cybersecurity program.

IT Risk Assessment: Evaluate cybersecurity and technology risks beyond PCI DSS and help leadership prioritize remediation.

IT Audit Services: Obtain an independent review of technology controls, governance, security practices, and compliance requirements.

A PCI policy should do more than just meet an assessor’s requirements.

It should clearly explain what your company expects, who is responsible for each task, and how your employees and IT team should protect payment systems and information.

Tanner Security can review your current policies, identify gaps, and help ensure your documentation matches your real security environment and PCI DSS requirements.