--- title: Common Key Controls Tested in PCI DSS Assessments description: Achieving compliance with the PCI DSS can be a daunting task. Bring in a QSA to guide you through the process. Here are some tips for a few quick wins. image: https://www.truvantis.com/hubfs/Blogs/Common%20Key%20Controls%20Tested%20in%20PCI%20DSS%20assessments.jpeg --- [![truvantis-logo-reverse@2x](https://www.truvantis.com/hs-fs/hubfs/Truvantis%20Logo/truvantis-logo-reverse@2x.png?width=1117&height=250&name=truvantis-logo-reverse@2x.png "truvantis-logo-reverse@2x")](https://www.truvantis.com) [![truvantis-logo-main@2x-1](https://www.truvantis.com/hs-fs/hubfs/Truvantis%20Logo/truvantis-logo-main@2x-1.png?width=1117&height=250&name=truvantis-logo-main@2x-1.png "truvantis-logo-main@2x-1")](https://www.truvantis.com/) ** ## Blog ![](https://www.truvantis.com/hs-fs/hubfs/Truvantis%20Logo/truvantis-logo-main@2x-1.png?length=200) # Common Key Controls Tested in PCI DSS Assessments May 11, 2021 As a company interested or required to become PCI DSS compliant, there is a list of key controls you must have in place, and appropriate evidence to be to be retained to provide the PCI DSS assessors during the testing period. Being able to easily identify where these controls live and how they are managed within your organization is essential. This article will give you an overview of some of the controls you will need to get a jump start on the PCI DSS compliance. One focal point of the validation will be how you manage your company's workstations used to manage the processing of cardholder data. This will include being able to identify who is assigned to what machine or service, being able to show that each machine has antivirus software installed, active, and updated regularly, as well as being able to provide the operating system and application update history for each device. The security policies covering your entire environment will also be examined for things like password timeout enforcement, password complexity requirements, and password expiry/reset procedures--just to name a few. Having a solid set of policies and standards around your network controls will be vital to your success, as will being able to show where your cardholder data is stored, how it is stored, how it is encrypted, and how it is accessed. Not only will the assessor need to see actual documentation of these policies, they will also need to see the control configurations and proof of their effectiveness. The PCI DSS assessors (QSAs) will need to see the ins and outs of your servers as well. Documentation such as the encryption architecture, server hardening standards, and sensitive data transfer procedures are only some of several documents needed in this effort. Below is a quick hit list of some of the important assets and sectors that will need to be covered by your policies, procedures, and standards. - Workstations - Servers - Storage devices - Networking, firewalls and load balancers - Passwords - Software and application development and deployment - How backups are performed - Physical security assets (cameras) - Cloud environments - Wireless networking - Identity and access management - Incident response Finally, having an effective way to test that these policies are being adhered to, and implementing technology to ensure that the controls are maintained are key to becoming and remaining compliant. While PCI DSS compliance only appears to require an annual validation, it is essential to be able to prove that all the relevant requirements are being met in a business-as-usual fashion throughout the year. It may be a rough routine at first, but after the first year of validation, you will not only get the hang of it, but you will also improve your overall security posture. Truvantis is a full-service information security consulting company with an highly trained and experienced staff who can assist you in starting or completing any part of the compliance journey. Whether you need a gap analysis, written policies and procedures, implementation guidance, or an assessment, our Professional Services team is available to assist, not just with PCI, but other common standards such as ISO 27001, ISO 27701, CIS, SOC 2, CCPA, CPRA, GDPR, HIPAA and more. Use the Contact Us button to start the conversation. #### Related Articles By Topic [PCI DSS](https://www.truvantis.com/blog/tag/pci-dss) ### Subscribe Here! ### Recent Posts ### Related Articles By Topic - [Security Program (76)](https://www.truvantis.com/blog/tag/security-program) - [vCISO (38)](https://www.truvantis.com/blog/tag/vciso) - [CISO (35)](https://www.truvantis.com/blog/tag/ciso) - [PCI DSS (28)](https://www.truvantis.com/blog/tag/pci-dss) - [SOC2 (28)](https://www.truvantis.com/blog/tag/soc2) - [Penetration Testing (27)](https://www.truvantis.com/blog/tag/penetration-testing) - [Privacy (26)](https://www.truvantis.com/blog/tag/privacy) - [Risk Assessment (19)](https://www.truvantis.com/blog/tag/risk-assessment) - [CIS Controls (12)](https://www.truvantis.com/blog/tag/cis-controls) - [Red Teaming (8)](https://www.truvantis.com/blog/tag/red-teaming) - [HIPAA (7)](https://www.truvantis.com/blog/tag/hipaa) - [Threat Intelligence (7)](https://www.truvantis.com/blog/tag/threat-intelligence) - [ISO27001 (6)](https://www.truvantis.com/blog/tag/iso27001) - [CCPA (5)](https://www.truvantis.com/blog/tag/ccpa) - [CPRA (2)](https://www.truvantis.com/blog/tag/cpra) - [GDPR (2)](https://www.truvantis.com/blog/tag/gdpr) - [Ransomware (2)](https://www.truvantis.com/blog/tag/ransomware) - [Red Team (2)](https://www.truvantis.com/blog/tag/red-team) - [HITRUST (1)](https://www.truvantis.com/blog/tag/hitrust) [See all](https://www.truvantis.com/blog/common-key-controls-tested-in-pci-dss-assessments#) Contact Us Chat with our team about your PCI DSS compliance program. [![Schedule a call](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/4366475/125e3f02-ba89-460a-a1fb-d9059cd96dbb.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/4366475/125e3f02-ba89-460a-a1fb-d9059cd96dbb) [![Contact Us](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/4366475/ccf084a3-d095-4418-80d6-891f8fdade46.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/4366475/ccf084a3-d095-4418-80d6-891f8fdade46) ### Recent Articles ![Truvantis - Cybersecurity Maturity - One Size Does Not Fit All ](https://www.truvantis.com/hubfs/Blogs/Cybersecurity%20Maturity%20-%20One%20Size%20Does%20Not%20Fit%20All.png) PCI DSS, CIS Controls, Security Program, Privacy, ISO27001 [ Cybersecurity Maturity - One Size Does Not Fit All – Rick Folkerts ](https://www.truvantis.com/blog/cybersecurity-maturity-one-size-does-not-fit-all-rick-folkert) It's common knowledge that enterprise organizations need effective security, privacy and compliance programs to survive and grow. There are a handful of generic best practices but beyond that, cybersecurity programs must be tailored to... [Read more **](https://www.truvantis.com/blog/cybersecurity-maturity-one-size-does-not-fit-all-rick-folkert) ![The Silver Bullet Defense to Ransomware – by Andy Cottrell](https://www.truvantis.com/hubfs/Blogs/The%20Silver%20Bullet%20Defense%20to%20Ransomware%20%E2%80%93%20by%20Andy%20Cottrell.png) Ransomware [ The Silver Bullet Defense to Ransomware – by Andy Cottrell ](https://www.truvantis.com/blog/the-silver-bullet-defense-to-ransomware-by-andy-cottrell) In an era of cost-cutting, downsizing and generally insufficient budgets for everything, we are often asked, what is the one, main thing to do to protect against a ransomware attack? According to Statista, in 2022, there were 493.33 mi... [Read more **](https://www.truvantis.com/blog/the-silver-bullet-defense-to-ransomware-by-andy-cottrell) ![Cryptographic Agility – by Jeff Hall (the ’PCI Guru’)](https://www.truvantis.com/hubfs/Blogs/Cryptographic%20Agility%20%E2%80%93%20by%20Jeff%20Hall%20(the%20%E2%80%99PCI%20Guru%E2%80%99).png) Security Program [ Cryptographic Agility – by Jeff Hall (the ’PCI Guru’) ](https://www.truvantis.com/blog/cryptographic-agility) With the advent of quantum computing, a new threat has been added to the information security mix. The threat is today’s secure cryptography may not be secure once quantum computers reach their potential. The threat to cryptography has... [Read more **](https://www.truvantis.com/blog/cryptographic-agility) [![truvantis-logo-white@2x-1](https://www.truvantis.com/hs-fs/hubfs/Truvantis%20Logo/truvantis-logo-white@2x-1.png?width=1117&height=250&name=truvantis-logo-white@2x-1.png "truvantis-logo-white@2x-1")](https://www.truvantis.com/) [info@truvantis.com](mailto:info@truvantis.com) +1 (415) 422-9844 © 2024 Truvantis, Inc All Rights Reserved. [Privacy Policy](https://www.truvantis.com/privacy-policy)    [Terms of Service ](https://www.truvantis.com/terms-of-service) ![](https://px.ads.linkedin.com/collect/?pid=2614233&fmt=gif) ![](https://ws.zoominfo.com/pixel/dnjpprEKcMtv41HRInFR)