Internal Security Assessor (ISA) is a designation given by the PCI Security Standards Council to eligible internal security audit professionals working for a qualifying organization.[1] The intent of this qualification is for these individuals to receive PCI DSS training so that their qualifying organization has a better understanding of PCI DSS and how it impacts their company. Becoming an ISA can improve the relationship with Qualified Security Assessors and support the consistent and proper application of PCI DSS measures and controls within the organization. The PCI SSC's public website can be used to verify ISA employees.[2]

An ISA is also able to perform self-assessments for their organization as long as they are not a Level 1 merchant [3]

ISA training is only available for merchants and processors.[4] Organizations are required to have an internal audit department and cannot be affiliated with a Qualified Security Assessor or Automated Scanning Vendor (ASV) company in any way.

Certificate Renewal

The ISA certification must be renewed annually. The ISA certification is company specific. If the certified individual leaves the company that sponsored them, the certification is no longer valid [5] The good news is you are no longer required to complete the onsite training. Requalifying ISA Training currently costs $1,095. This includes training modules and the exam. Once an individual successfully completes the exam they will receive their renewed Certificate of Qualification.

References

  1. ↑ [1]“Internal Security Assessor (ISA) Program.” [Online]. Available: https://www.pcisecuritystandards.org/assessors_and_solutions/become_isa. [Accessed: 22-Feb-2018].
  2. ↑ [1]“Official PCI Security Standards Council Site - Verify PCI Compliance, Download Data Security and Credit Card Security Standards.” [Online]. Available: https://www.pcisecuritystandards.org/assessors_and_solutions/internal_security_assessors. [Accessed: 22-Feb-2018].
  3. ↑ [1]“Can a PCI Internal Security Assessor validate level 1 merchants?,” SearchSecurity. [Online]. Available: http://searchsecurity.techtarget.com/answer/Can-a-PCI-Internal-Security-Assessor-validate-level-1-merchants. [Accessed: 22-Feb-2018].
  4. ↑ [1]“Avoid Paying For PCI Certification You Don’t Need | FierceRetail.” [Online]. Available: https://www.fierceretail.com/operations/avoid-paying-for-pci-certification-you-don-t-need Archived 2022-05-17 at the Wayback Machine. [Accessed: 23-Feb-2018].
  5. ↑ [1]J. Vijayan, “PCI council launches certification program for IT staff,” Computerworld, 30-Apr-2010. [Online]. Available: https://www.computerworld.com/article/2517837/security0/pci-council-launches-certification-program-for-it-staff.html. [Accessed: 22-Feb-2018].
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.