Appendix C PCI READINESS REVIEW CHECKLIST
All changes in this version
Title changed
Before · SP 800-79-1
PCI READINESS REVIEW CHECKLIST
After · SP 800-79-2
PCI READINESS REVIEW CHECKLIST
Control changed
Before · SP 800-79-1
The readiness review checklist may be used by a PCI preparing for assessment and accreditation by an assessment team. The checklist may also be used to validate that the PCI has collected all relevant documentation, identified appropriate individuals with knowledge of the PCI and made them available, and provided access to the PCI to the assessment team.
Activity Completed? Comments
• Identify an independent assessment team to assess the PCI.
• Determine the accreditation boundary.
• Establish the scope and objectives of the assessment.
• Determine the level of effort and resources necessary to carry out the assessment.
• Establish the time-frame to complete the assessment and identify key milestone decision points.
• Notify key personnel at the PCI Facility and any external service providers (if applicable) of the impending assessment.
• Validate that the PCI operations plan is complete and includes all the required information.
• Ensure that the necessary roles within the PCI have been designated.
• Validate that implementation and management responsibility for PCI controls have been accurately assigned.
• Make sure that the information systems utilized by the PCI have been certified and accredited to operate in accordance with SP 800-37.
• Ensure that the following documentation has been developed and can be made available to the assessment team: (i) PCI operations plan (ii) Results from any past assessment and accreditation decisions for the PCI (iii) Letters of appointment (if any) (iv) Service Level Agreements (SLA) and Memorandums of Understanding (MOU) between the organization and the service provider(s). Activity Completed? Comments (v) Listing of all HSPD-12 components used within the PIV system (vi) Privacy-related documentation (vii) All forms utilized within the PCI (viii) Documentation from outsourced providers (ix) Standard operating procedures for the PCI Facilities within the accreditation boundary for the PCI (x) Signed accreditation letter under SP 800-37 for each information system within the PCI
• The PIV system is operational and actual PIV processes can be observed by the assessment team.
• The PIV system is in production and operational. PIV Cards are being or ready to be produced that can be used for testing by the assessment team.
After · SP 800-79-2
The readiness review checklist may be used by a PCI preparing for assessment and accreditation by an assessment team. The checklist may also be used to validate that the PCI has collected all relevant documentation, identified appropriate individuals with knowledge of the PCI and made them available, and provided access to the PCI to the assessment team.
Activity Completed? Comments
• Identify an independent assessment team to assess the PCI.
• Determine the accreditation boundary.
• Establish the scope and objectives of the assessment.
• Determine the level of effort and resources necessary to carry out the assessment.
• Establish the time-frame to complete the assessment and identify key milestone decision points.
• Notify key personnel at the PCI Facility and any external service providers (if applicable) of the impending assessment.
• Validate that the PCI operations plan is complete and includes all the required information.
• Ensure that the necessary roles within the PCI have been designated.
• Validate that implementation and management responsibility for PCI controls have been accurately assigned.
• Make sure that the information systems utilized by the PCI have been certified and accredited to operate in accordance with SP 800-37.
• Ensure that the following documentation has been developed and can be made available to the assessment team: (i) PCI operations plan (ii) Results from any past assessment and accreditation decisions for the PCI (iii) Letters of appointment (if any) (iv) Service Level Agreements (SLA) and Memorandums of Understanding (MOU) between the organization and the service provider(s). Activity Completed? Comments (v) Listing of all HSPD-12 components used within the PIV system (vi) Privacy-related documentation (vii) All forms utilized within the PCI (viii) Documentation from outsourced providers (ix) Standard operating procedures for the PCI Facilities within the accreditation boundary for the PCI (x) Signed accreditation letter under SP 800-37 for each information system within the PCI
• The PIV system is operational and actual PIV processes can be observed by the assessment team.
• The PIV system is in production and operational. PIV Cards are being or ready to be produced that can be used for testing by the assessment team.