TodayTools

SOC 2 and PCI DSS flashcards

The trust report US buyers ask for, and the card data security standard.

Donate
Beginner friendly, starts from zero
Section
How to study
0
SOC 2 and PCI DSSStart from zero · 1 of 12

What are SOC 2 and PCI DSS, in one plain sentence?

They are two well-known sets of security checks that companies go through to prove they keep customer data safe. SOC 2 is for services that hold customer data; PCI DSS is for anyone handling payment cards.

SOC 2 = proof you are careful. PCI DSS = rules for card numbers.

All topics

SOC 2 and PCI DSS at a glance

SOC 2 and PCI DSS are independent security checks that prove a company keeps customer and card data safe.

SOC 2 is a restaurant hygiene report by an outside inspector; PCI DSS is the strict rule book for a bank vault.

Words you will meet

Control
A rule or tool that protects data, like a lock or a backup
Evidence
Proof that a control really works
Attestation
An auditor's written opinion, not a certificate
CPA firm
A licensed US accounting company allowed to sign SOC reports
Merchant
A shop or business that takes card payments
Acquiring bank
The shop's bank that receives card payments
PAN
The long card number on the front of a card
Scope
Which systems the rules cover

The steps

  1. 1. Start from zero (12 cards): What these security checks are, who asks for them, and the plain words auditors and banks use.
  2. 2. Core basics (14 cards): What each one is, who needs it and the core terms.
  3. 3. Next steps (16 cards): Running SOC 2 and the 12 PCI DSS requirements.
  4. 4. Go deeper (16 cards): SAQ choice, scope reduction and running both programmes.
All 12 cards in Start from zero
What are SOC 2 and PCI DSS, in one plain sentence?
They are two well-known sets of security checks that companies go through to prove they keep customer data safe. SOC 2 is for services that hold customer data; PCI DSS is for anyone handling payment cards.
What problem do they solve?
A big customer cannot visit every supplier to inspect its security. One independent check gives a trusted answer, instead of hundreds of long questionnaires from every customer.
Where do you already meet them in daily life?
When you pay by card online, PCI DSS rules are why the shop never keeps your full card number in plain sight. When your office picks a new software tool, someone usually asks the seller for its SOC 2 report.
What everyday thing are they like?
SOC 2 is like a restaurant's hygiene report written by an outside inspector who watched the kitchen for months. PCI DSS is like the strict rule book for running a bank vault.
What are a control and evidence?
A control is a rule or tool that protects data, like a lock, a password rule or a daily backup. Evidence is proof the control really works, such as records, logs and screenshots.
What are an audit, an auditor and an attestation?
An audit is an outside expert, the auditor, checking your controls and evidence. An attestation is the auditor's written opinion in a report, which is different from a certificate.
What are a CPA firm and the AICPA?
A CPA is a licensed accountant in the United States, and a CPA firm is a company of them. The AICPA is their professional body, and it writes the rules for SOC reports.
Who is who in a card payment?
The merchant is the shop taking the card, and the card brands are networks like Visa and Mastercard. The acquiring bank is the shop's bank that receives card payments, and service providers are companies that handle cards for others.
What are the card number (PAN), CVV, PIN and authorisation?
The PAN is the long number on the front of the card, the CVV is the short code on the back, and the PIN is your secret number. Authorisation is the moment the bank says yes to a payment.
What do compliance, a standard, scope and an assessment mean?
A standard is a written set of rules, and compliance means meeting it. Scope is which systems the rules cover, and an assessment is the check that you meet them.
What do you need before you start?
Nothing to install and no coding. It helps to know that a server is a computer that runs an online service and a database is where it keeps records.
What will you be able to do after this topic?
Explain what a SOC 2 report and PCI DSS are, pick the right report type, know which card data you may never keep, and talk with auditors and banks in their words.
SOC 2 and PCI DSS cheatsheet

SOC 2 basics

  • Security (CC) Always in scope
  • A, PI, C, P Availability, Processing Integrity, Confidentiality, Privacy
  • Type I Design at a date
  • Type II Operating over 3 to 12 months
  • SOC 1 / SOC 3 Financial controls / public summary
  • Bridge letter Covers gap since last period
  • CUEC Controls customers must run

PCI DSS 12 requirements

  • 1, 2 Network controls, secure configs
  • 3, 4 Protect stored data, encrypt in transit
  • 5, 6 Anti-malware, secure software
  • 7, 8 Need to know, authentication and MFA
  • 9, 10 Physical access, logging
  • 11, 12 Testing, policies and programme

SAQ types

  • A Fully outsourced e-commerce or mail/phone
  • A-EP Site affects payment page
  • B / B-IP Dial-out / IP standalone terminals
  • C-VT Web virtual terminal
  • C Payment app on internet
  • P2PE Validated P2PE solution
  • D Everyone else, all service providers

PCI clocks

  • Quarterly Internal scans and ASV external scans
  • 12 months Pen test, scope confirmation
  • 6 months Segmentation test, service providers
  • 31 Mar 2025 v4 future dated reqs mandatory
  • 31 Dec 2024 v4.0 retired; v4.0.1 current

Never store

  • CVV2 / CVC2 After authorisation
  • Full track data After authorisation
  • PIN / PIN block After authorisation
  • PAN in clear Mask, hash, truncate, tokenise or encrypt
Donate