2.8.1 Issuer Duties (was: PCI Duties)
All changes in this version
Title changed
Before · SP 800-79-1
PCI Duties
After · SP 800-79-2
PCIIssuer Duties
Control changed
Before · SP 800-79-1
Before the assessment can begin, an Assessor must be designated. The Assessor conducts the assessment and oversees the assessment team if one is needed. The assessment team may be made up of employees from the organization or personnel provided by a public or private sector entity contracted to provide services. Members of the assessment team should have various capabilities that are required to perform the activities specified in this document. Assessment team members should work together to prepare for, conduct, and document the findings of the PCI’s assessment and assessments of all PCI facilities within the PCI boundary. Each team must be made up of individuals that collectively have the knowledge, skills, and abilities to conduct, evaluate, and document all assessments, including those performed on the information systems within the PCI.
Once an assessment team is in place, the OIMO and other relevant PCI personnel should begin the preparation for the assessment. Thorough preparations by both the PCI and the assessment team are important aspects of conducting an effective assessment. The PCI sets the stage for the assessment by identifying all appropriate personnel and making them available during the assessment. A fundamental requirement for accreditation is interviews by the assessment team of all PCI personnel. Personnel and officials must be notified of the pending assessment, must understand their roles in the process, and must be made available in accordance with the planned assessment schedule.
The OIMO must ensure that all relevant documentation has been completed and organized before the assessment begins. This documentation includes policies and procedures, organizational structure, information system architecture, product and vendor details, and specifics regarding the implementation of all the requirements from FIPS 201-1 and related publications. If the PCI has outsourced functions to an external service provider, all necessary documentation must be obtained from the provider regarding those operations utilized by the PCI. Before providing any documentation to the assessment team, the OIMO must review it to make certain it is both current and approved.
Another significant activity during the assessment is the observation by the assessment team of actual processes performed by the PCI. In order for the assessment team to confirm that processes are implemented in accordance with the operations plan, the PCI will need to ensure that assessment team members have access to, and are able to observe, PCI processes in real time. This could include scheduling enrollment/identity proofing, adjudication, card production, card activation/issuance, and maintenance activities for observation by the assessment team.
In order to aid the PCI’s planning and preparation for the assessment, Appendix C includes a readiness review checklist. The checklist contains items needed during the assessment process. Satisfying this list of items before the assessment commences will facilitate efficient utilization of the assessment team’s time, and will contribute towards the overall effectiveness of the assessment activity.
After · SP 800-79-2
Before the assessment can begin, an Assessor must be designated. The Assessor conducts the assessment and oversees the assessment team if one is needed. The assessment team may be made up of employees from the organization or personnel provided by a public or private sector entity contracted to provide services. Members of the assessment team should have various capabilities that are required to perform the activities specified in this document. Assessment team members should work together to prepare for, conduct, and document the findings of the PCI’s assessment and assessments of all PCI facilities within the PCIauthorization boundary. Each team must be made up of individuals that collectively have the knowledge, skills, training and abilities to conduct, evaluate, and document all assessments, including those performed on the information systems withinbeing used by the PCIissuer.PCI personnel should begin the preparation for the assessment. Thorough preparations by both the PCIissuer organization and the assessment team are important aspects of conducting an effective assessment. The PCIissuer sets the stage for the assessment by identifying all appropriate personnel and making them available during the assessment. A fundamental requirement for accreditationauthorization is interviews by the assessment team of all PCIissuer personnel. Personnel and officials must be notified of the pending assessment, must understand their roles in the process, and must be made available in accordance with the planned assessment schedule.
The OIMO must ensure that all relevant documentation has been completed and organized before the assessment begins. This documentation includes policies and procedures, organizational structure, information system architecture, product and vendor details, and specifics regarding the implementation of all the requirements from FIPS 201-1201-2 and related publications. If the PCIissuer has outsourced functions to an external service provider, all necessary documentation must be obtained from the provider regarding those operations utilized by the PCIoutsourced operations. Before providing any documentation to the assessment team, the OIMO must review it to make certain it is bothcomplete, current and approved.
Another significant activity during the assessment is the observation by the assessment team of actual processes performed by the PCIissuer. In order for the assessment team to confirm that processes are implemented in accordance with the operations plan, the PCIissuer organization will need to ensure that assessment team members have access to facilities, and are able to observe, PCIPIV processes in real time. This could include scheduling enrollment/activities to observe identity proofing, adjudication, card/token production, card activation/issuance, and maintenance activities for observation by the assessment teamprocesses.
In order to aid the PCI’sissuer’s planning and preparation for the assessment, Appendix C includes aan issuer readiness review checklist. TheThis checklist contains items needed during the assessment process. Satisfying thisthe list of items before the assessment commences will facilitate efficient utilization of the assessment team’s time, and will contribute towards the overall effectiveness of the assessment activity.