Cybersecurity Risk Assessment and PCI DSS

Updated on April 25, 2022 by Mike Mariano

Share this article!

Within today’s world, compliance is a top priority of the masses. Compliance with various security regulations and frameworks not only helps to ensure a company’s overall security, but it is also a valuable marketing strategy that is used to promote a company’s commitment to security.

What is PCI DSS and why do some companies need to be PCI DSS compliant?

The Payment Card Industry Data Security Standard (PCI DSS) is mandated by major credit card brands but administered by the Payment Card Industry Security Standards Council. The standard was created to increase security controls around cardholder data to reduce credit card fraud. PCI DSS is mandatory for any organization that accepts, transmits, or stores cardholder data, however many organizations that may or may not handle cardholder data still strive for PCI DSS compliance. While most companies are compliant with PCI DSS version 3.2.1, a new version (4.0) was recently released and will eventually replace the old version.

Requirement 12.2 – Cybersecurity Risk Assessment

Within high-level Requirement 12 of the PCI DSS, organizations are responsible for performing annual cybersecurity risk assessments across the organization, particularly within their cardholder data environment (CDE). This is to ensure potential risks related to data transmission and storage are identified, measured, and managed to assist in providing consumers with assurance that their data is secure.

Below are the 5 steps to complete a PCI Cybersecurity Risk Assessment:

1. Map Card Data Flow
   • Where does cardholder data enter the organization?
   • Where does the system process cardholder data?
   • Where does cardholder data leave the organization?
   • Where does the system store cardholder data?
2. Identify Vulnerabilities, Threats, and Risks
   • Organizational flaws
   • Technical flaws
   • Environmental flaws
3. Analyze Risk Level
   • Risk rating
   • Risk likelihood
   • Risk impact
4. Create a Risk Management Plan
   • Identify security controls implemented and method of maintaining
   • Prioritize highest risk areas
5. Create PCI Documentation
   • Cybersecurity Risk assessment report

Cybersecurity Risk Assessment Precursors

There are some common security practices that should be performed by all organizations prior to conducting a cybersecurity risk assessment:

1. Internal & External Vulnerability Scans. Vulnerability scans are a recognized way to identify possible holes within a network where malicious actors can enter.
2. Penetration Tests. While vulnerability scans identify possible holes, penetration tests utilize these results and attempt to exploit possible vulnerabilities. This practice takes vulnerability management to the next level to ensure any exploitable vulnerabilities are promptly remediated.

Evaluating Your Cybersecurity Risk Management Program

Not sure where to begin?  Let AWA International Group help by performing a PCI DSS Gap Analysis.  During a PCI DSS Gap Analysis, AWA will help achieve the following:

• Advice on the organization’s current cybersecurity risk assessment strategy
• Identify existing security controls & gauge strengths / weaknesses
• Conduct vulnerability scans
• Perform penetration tests
• Analyze gaps in current capabilities
• Measure security maturity against the PCI DSS

About The Author

Mike Mariano

Michael is the Chief Information Security Officer at IS Partners as well as the leader of the penetration testing practice for AWA International. Michael has 15+ years’ experience in internal IT operations with 7 years of being involved in various levels of IT auditing with experience with PCI DSS, SOC 2, HITRUST CSF, Risk Assessments and experience working with Security Frameworks (such as ISO and NIST). Michael has worked with/at companies from 10 to 50,000 employees in size. Prior to joining IS Partners, Michael worked as the IT Operations Manager at AVASEK an MSP IS Security firm where he managed a team of six technicians to service 1500 client endpoints as well as the firm's Cloud Hosting Solution. while at AVASEK, Michael also performed gap assessments against HIPPA and NIST Security Frameworks and was a member of the incident response team. Michael’s specialties are IT Security and IT Management. He is experienced in performing security Risk Assessments, enforcing security policies, handling confidential information, deploying and administering network and application security systems, administrating SaaS products, Active Directory (AD), firewalls, routers, and VPN. Michael is HITRUST CCSFP and AWS CP Certified and has maintained various CompTIA Certifications over his career. He is currently working to achieve his GIAC GWAP and OSCP Certification in 2020.