PCI Portal

[Link] user guide – Merchant Role

 Table of contents

• What’s included? ……………………………………………………………………….. 3

• The process ……………………………………………………………………….. 4

• Welcome to the program ……………………………………………………………….. 5

• Login ….………….……………………………………………………….. 6

…………….……………………………………………………….. 7
• First time user?
….………….……………………………………………………….. 8
• Your profile
• How you accept payments
• Information Security Policy
• Payment summary

• Your dashboard ……………...……………………………………………………….. 12

• Scanning ……………...……………………………………………………….. 16

• Finding your IP address …..…………………………………………………….. 19

• Security Assessment Questionnaire (SAQ) ………………………….. 20

• You’re done for now …..……...……………………………………………………….. 27

• Maintaining your compliance ………………………………………………….. 28

• Upload an existing certificate ……………………………………………….. 30

2
What’s included?

• Report your PCI DSS Compliance

• Streamlined and simplified journey
• Download your Information Security Policy template

• Maintain your compliance throughout the year

• Login to complete regular scanning and maintenance tasks

• Receive email alerts and reminders so you always stay up to date

• Rich online, chat and phone support available if you get stuck
The process

1 2 3 4 5

Login Profile Scanning Security Assessment Maintenance

Login to the portal and Complete your Complete scanning on Complete your You may need to
change your password business profile by your network if Security Assessment maintain your
answering questions applicable to your Questionnaire (SAQ) – compliance. We’ll
on how you accept business profile type an online assessment remind you by email if
payments of your security this is the case.
practices
Welcome to the program

• When you have been loaded to the program, you will receive two
emails.
• The first email will be your username
• The second will be your password

• When you receive these two emails you can use this information
to login.
• Click the login link in the email to be brought to your portal.
Login

• Upon first logging in to the portal, use the username

and password provided in your emails and click ‘Login’

• You will then be prompted to update your password.

Your password will need to meet the minimum-
security criteria outlined on the screen

• Once you have completed this, you will be brought to

an information page that gives you an overview of
what you need to do and an information video

• Click ‘Start Business Profile’ to begin

First time use?

The first screen you will encounter is a question as to whether you

have completed this already.
In some cases, you may have already completed your PCI compliance
with an assessment company. If this is the case, select the option and
click ‘Next’.

If you do not already have a valid certificate and need to complete

your compliance online, select the first option on this screen and
continue to page 8 of this guide.

If you already have a valid certificate, select the second

option and proceed to page 30 of this guide for instructions
on uploading your existing Attestation of Compliance (AoC).
Your Profile
How you accept payments
 Profile – How you accept payments

• You will be guided through some questions asking how you

accept payments in your business.

• You will be asked questions about the technology you use as well
as methods by which you may transfer or store data.

• Select the options that apply to your company and click through
via the “Next” button. You can select more than one option in
many cases.

• If you are unsure about any of the options or need further

clarification, more information is available by clicking the help
icon.
 Profile – Information Security Policy

• It’s mandatory to apply an Information Security Policy

• This is a document that sets out the procedures you need
to follow to handle information securely
• You will be asked if you have a policy in your business. If you
don’t, you can download a sample template by clicking
‘Download’

• To correctly implement your policy, you must:

• Tailor the sample template to suit your business

• Ask all staff and third parties who come in contact with
your data to read, sign and date it
• Keep it on your business’ premises and keep it up to date
if/when your processes change
Profile – Payment Summary

• You will be asked to provide a summary of your payment

acceptance processes.
• You will be asked to:

• List your business premises and provide a summary of the

locations where you accept payments
• Explain how your business handles cardholder data
• Provide a high-level description of how you accept
payments

• Please provide as much information as possible. If you are stuck,

help is available by clicking the help icon.
Your dashboard
Profile complete
 Your dashboard

• Now that you have answered your profile questions,

you will be presented with your dashboard.

• From here you can complete your security

assessment as well as any other tasks that are
assigned to you following your questions (e.g.
scanning).
• Your security assessment will be based on the
profile type assigned to you.

• You can read more information on how this works via

the ‘More Info’ button on the ‘Your business profile’
widget.

• If the scanning widget appears, you must complete a

scan by selecting ‘Manage’ from this widget.

• If you do not require a scan, or have completed one,

you can begin your security assessment by clicking
‘Manage’ on the relevant widget.

See next page for a visual explanation

Your dashboard

1 Your compliance status

is listed in the top right.
You will have been You will not yet be
assigned a business compliant as you won’t
profile type, based on have completed your
the answers you scanning (if applicable)
provided in your or Security Assessment
questions. You can read yet.
more on what this
means by clicking ‘More
Info’

2 When you have

completed your
If applicable, you can scanning (if applicable)
conduct your scanning you can proceed to
from here. Click your security
‘Manage’ on the scan assessment by clicking
widget to begin. ‘Manage’
 Next steps Profile

Scanning Proceed to page 15

Scanning
If applicable to you, you will need to run a scan on your network.
Proceed to page 15 for instructions.

Security Proceed to page 18

Security Assessment Assessment

If don’t have to do a scan, you can proceed to your security
assessment on page 18.

Compliance
External Vulnerability
Scanning
 Scanning

• From your dashboard, select ‘Manage’ on the ‘Be scan

compliant’ widget.

• On the next page, select ‘Schedule scan’.

Scanning

• On the next screen you will need to input some details as

follows:
• The IP address. This must be the same IP address as used by your card
payment machine.
• Scan date. It will default to the current date and time. You can change
this if necessary
• Confirmation of whether you use a load balancer

• Once complete, select ‘Schedule Scan’

• The scan will then run and can take up to 48 hours. You will receive an
email when the scan is complete.
• You will be notified if remediation action is needed via your dashboard.
• If you scan fails, you will need to complete the recommended
remediation and then rerun the scan until a passing grade is achieved
 Finding your IP Address

• To conduct a scan, you will need to provide us with your IP

address. This is a series of numbers and dots that is your
address on the internet. This helps to ensure the scan runs
on the correct network.

• To find your IP address:

• Connect a laptop, desktop or mobile device to the same Wi-Fi
network that your card payment machine is connected to
• Open your preferred search engine or browser and search
“What is my IP address”
• You can find your address from the search results
• Please note, it is the IPV4 address that is required, not the
IPV6
Security assessment questionnaire
SAQ
 Next steps Profile

Scanning

Security Assessment Questionnaire

(SAQ)
Your security assessment is an assessment of how you deal with
information in your business. Its length and complexity depends on
the results of your business profile. Security Proceed to next page

The system will prepopulate any questions that don’t apply to you. Assessment
So you only have to answer those that really matter.

Compliance
 Security Assessment Questionnaire (SAQ)

• From your dashboard, select ‘Manage’ on the

‘Complete security assessment’ widget.

• You will see on your dashboard how many

questions you must answer.
• The amount of questions you must answer
depends on the business profile assigned
to you and is based on your level of risk.
Security Assessment Questionnaire (SAQ)

1 3

You will be guided The box on the top right shows

through the questions you your progress through the
need to answer to questionnaire. Many of the
complete your Security questions will have been
Assessment prepopulated for you based on
your answers in the profile
section. This greatly streamlines
the process.

2 4

More information is Work your way through

available via the box the questionnaire by
underneath to help you answering “Yes”, “No” or
understand the question “N/A” to the questions
 Security Assessment Questionnaire (SAQ)

• If an answer you provide is against best practice or what is

correct, you may need to further explain your answer or assign
yourself a remediation task.
• You must then fill out your reasons for non-compliance, the
remediation action you intend to take and can then set a
reminder to yourself to follow up.

• You can continue with your assessment questions. However,

until these tasks are completed correctly you may not be able to
complete your assessment.
 Security Assessment Questionnaire (SAQ)

• Once you have answered all your questions correctly, you

will be need to attest to your compliance. This simply means
to confirm the information you have provided is correct.

• You can review all the answers you provided to the

questions here.

• Once happy, select ‘Confirm your Attestation’ at the bottom

of the screen.
 Next steps
Profile

Scanning

You’ve validated your compliance

Your validation must be renewed annually. Your renewal date will be
shown on your dashboard.

We will email you to remind you when it’s time to revalidate. Security
Assessment

Compliance Proceed to put your feet up

You’re done for now

2
1
Your revalidation date is
Your dashboard should displayed in the top right
have green ticks across corner
the board
Maintaining compliance
Throughout the year
 Maintaining your compliance

It’s important to maintain your compliance throughout the year by:

• Making sure you do all of the things you said you did in your assessment

• Applying your Information Security Policy and keeping it up to date

Depending on your business profile, you may have to conduct tasks, such as
scanning throughout the year. You’ll need to perform these tasks on the
portal.

You’ll receive emails to remind you, if applicable.

If you receive an email, log in to your portal.

What you need to do will be outlined on your dashboard under ‘Task Center’.
Uploading an existing attestation
Already have a valid Attestation of Compliance?
 Uploading existing Attestation of Compliance

• If you select that you have an existing attestation of compliance, you

will then be asked two questions:
• The PCI Compliance assessment type of your business. You can find
this on your existing certificate.
• You’ll also need to confirm if you use a third party to store or process
card payments.

• You’ll then arrive at your dashboard. The main widget will instruct
you to confirm your compliance.
• Select ‘Begin Step’ to start.
 Uploading existing Attestation of Compliance

• On the following page you will need to complete two steps

• Upload your existing documents.
• You will need to upload your Attestation of Compliance
(AoC) that proves you are currently compliant. This is the
certificate your third-party company should have provided
you when you achieved compliance.
• Confirm the details, acknowledge your status and attest to
your compliance.

Instructions on the following pages.

 Uploading existing Attestation of Compliance

1 2

3
• Upload your documents

• Select ‘Upload’
• Select the necessary document(s) from your files
• Provide details of the document you are uploading and
select ‘Upload’
 Uploading existing Attestation of Compliance

• Select from your uploaded documents to attach to 2

the attestation
• Click ‘Select’ from the main screen

• From the list of uploaded documents, select the

ones you wish to attach to this attestation. 3
Click ‘Add’

• The documents you wish to include will now

appear on the main screen
 Uploading existing Attestation of Compliance

• Confirm details of your attestation, including:

• Assessment type.
• Validation effective date.
• The version of the PCI DSS to which you are compliant with.
1

• Confirm by checking the boxes, that you acknowledge a

number of conditions in relation to your status and
attestation. 2

• Click ‘Attest’ to finish. Your validation is now complete.

• See page 29 for details on maintaining your compliance.

3
Thank you

THANK YOU