 |
PCI DSS - Payment Card Industry Data Security Standard
|
The PCI DSS is a multifaceted security standard
that includes requirements for security management, policies,
procedures, network architecture, software design and other critical
protective measures. PCI DSS was developed by the major credit card
companies as a guideline to help organizations that process card
payments prevent credit card fraud, cracking and various other
security vulnerabilities and threats. A company processing, storing,
or transmitting payment card data must be PCI DSS compliant or risk
losing their ability to process credit card payments and being
audited and/or fined.
The core of the PCI DSS is a group of principles and accompanying
requirements, around which the specific elements of the DSS are
organized:
The Payment Card Industry (PCI) Data Security Standard (DSS) is
available at:
https://www.pcisecuritystandards.org/pdfs/pci_dss_v1-1.pdf
 |
SAS 70 or Statement on Auditing Standards No.
70:
Service Organizations Type II
|
BlueBridge Networks completed SAS 70 Type I for
controls in place as of June 30, 2007, and has completed SAS 70 Type
II audit as of December 31 2007. Audits are required every six
months in order to remain compliant. The most recent Type II report
is available for review upon request.
SAS 70 or Statement on Auditing Standards No. 70: Service
Organizations, commonly abbreviated as SAS 70, is an auditing
statement issued by the Auditing Standards Board of the American
Institute of Certified Public Accountants (AICPA), officially titled
“Reports on the Processing of Transactions by Service
Organizations”. SAS 70 defines the professional standards used by a
service auditor to assess the internal controls of a service
organization and issue a service auditor’s report. Service
organizations are typically entities that provide outsourcing
services that impact the control environment of their customers.
There are two types of service auditor reports.
-
Type I service
auditor’s report includes the service auditor's opinion on the
fairness of the presentation of the service organization's
description of controls that had been placed in operation and the
suitability of the design of the controls to achieve the specified
control objectives.
-
Type II service auditor’s report includes the
information contained in a Type I service auditor's report and also
includes the service auditor's opinion on whether the specific
controls were operating effectively during the period under review.
For more information about SAS 70 is available
at:
The American Institute of Certified Public Accountants (AICPA)
|
