What is a QIR?

Does your company use a Qualified Integrator and Reseller, or QIR? You’re likely here because you’ve been asked that question on your PCI Self-Assessment Questionnaire and you have no idea what in the world a QIR is! ControlScan is here to help. By the end of the video below, you’ll know what a QIR is, why you need one, and how to make sure your business is using one.

Check out ControlScan's blog, PCI Compliance Guide, to learn more.

Security with a Purpose Podcast

ControlScan's Security with a Purpose is an information security podcast that takes an in-depth look at the various aspects of securing an organization.

Get tips, tricks and best practices from ControlScan experts to move purposefully toward stronger security and simplified compliance. Interviews by Jeff Wilder, Director of Risk & Compliance Management, ControlScan.

Check it out and subscribe today!

Apple Podcasts   |   Google Podcasts   |   Spotify   |   Stitcher

How companies can leverage point-to-point encryption (P2PE) to secure payments and to simplify the PCI compliance process.

Sam Pfanstiel, Director of Security Consulting Services at ControlScan, joined the Security with a Purpose podcast on May 19th, 2020 to discuss this hot topic.

Give it a listen here.

How ControlScan and Chesapeake Payment Systems Collaborated to Achieve a Mid-90s Portfolio Compliance Rate

Chesapeake Payment Systems Achieves Merchant Portfolio Compliance Goals with ControlScan.

Helpful tools, responsive service and simplified security make ControlScan a preferred partner. Read all about how it was done HERE.

New ControlScan “P2PE for Retail” White Paper Guides IT Leaders to Stronger Payment Security

Comprehensive white paper features tips and considerations for implementing point-to-point encryption in the retail environment.

ATLANTA, May 28, 2020 (GLOBE NEWSWIRE) -- ControlScan, a leader in managed security and compliance solutions that help secure IT networks and protect payment card data, has published its latest white paper, “Terminal Encryption for Security and PCI Compliance: What Every Retailer Must Know About P2PE.” The paper, authored by ControlScan Director of Security Consulting Sam Pfanstiel, is the latest in an ongoing series of educational resources offered by the company.

Retailers struggle with balancing the costs and benefits of investing in the latest payment security technologies, as well as understanding how these options may impact their Payment Card Industry (PCI) compliance. A baseline understanding of point-to-point encryption (P2PE) helps decision makers confidently select and implement solutions that meet their business requirements. It also protects the business from data breach and greatly simplifies its PCI assessment.

“Point-to-point encryption may seem very technical, but it’s important that retailers understand how it works to strengthen their payment security,” said Sam Pfanstiel, Director of Security Consulting Services, ControlScan. “In writing this white paper, I worked to present the basics in a logical, building-block flow of information that is both educational and actionable.”

The ControlScan P2PE for Retail white paper begins by exploring the purpose for PCI compliance and the P2PE program that is designed specifically to reduce PCI scope for merchants. It then goes on to discuss alternate approaches to secure encryption and their potential impact on a merchant’s security and compliance.

Click here to access a complimentary copy of the new white paper on ControlScan.com.

About ControlScan

ControlScan managed security and compliance solutions help secure IT networks and protect payment card data. Thousands of businesses throughout the U.S. and Canada partner with us for easy, cost-effective access to the expertise, technologies and services that keep cyber criminals and data thieves at bay. With highly credentialed cybersecurity and compliance experts; 24x7 managed detection and response; managed UTM firewall services; ASV vulnerability scanning; security penetration testing; PCI compliance programs and validation services; QSA and HIPAA assessments; and more, we’ve got your back. For more information visit ControlScan.com.

Press Contact:

Stacey Holleran

Director, Corporate Communications

678-694-0654

ControlScan Becomes One of the First PCI Software Security Framework Assessor Companies

Expanded application security assessment services give ControlScan customers more flexibility and increased software security.

ATLANTA, March 18, 2020 (GLOBE NEWSWIRE) -- ControlScan, a leader in managed security and compliance solutions that help secure IT networks and protect payment card data, has become one of the first Software Security Framework Assessor companies to be listed by the PCI Security Standards Council.

Software vendors for point-of-sale, middleware, payment switches, kiosks, shopping carts, call centers, fuel dispensers, and other transaction-related applications who validate according to the new SSF program can benefit from its streamlined process that supports efficient and agile code releases and defends against constantly evolving security attacks.

“The Software Security Framework really has changed the game for application security,” said Sam Pfanstiel, Director of Security Consulting Services, ControlScan. “The new set of standards is much more streamlined to accommodate today’s accelerated software lifecycle, because it supports the latest software integrity testing technologies while also giving significant consideration to the maturity of the vendor’s application design, development and management practices.”

ControlScan assessors are qualified to test for both secure software lifecycle (Secure SLC) and Secure Software. A combined assessment methodology enables quick and confident evidence collection and testing for listing as a Secure SLC Qualified Vendor and/or Validated Payment Software. In addition, these certifications work together to assure merchant and acquiring customers that such software will support their own PCI DSS compliance.

“We recommend the combined audit approach, since companies listed as Secure SLC Vendors can now self-attest to low-impact application changes without undergoing a third-party audit,” Pfanstiel said. “This can significantly reduce their time-to-market for software enhancements.”

The company’s SSF advisory services also support gap analyses against either or both assessment types, providing a clear path to compliance and listing under the new SSF program. In addition, ControlScan can produce white papers that detail the impact of a company’s SSF compliance to support its customers' PCI compliance.

The new SSF program will fully replace the Council’s Payment Application Data Security Assessor (PA-DSS) program by 2022, but ControlScan encourages eligible entities to utilize it now. For more information about ControlScan’s Software Security Framework validation services, please click here.

About ControlScan
ControlScan managed security and compliance solutions help secure IT networks and protect payment card data. Thousands of businesses throughout the U.S. and Canada partner with us for easy, cost-effective access to the expertise, technologies and services that keep cyber criminals and data thieves at bay. With highly credentialed cybersecurity and compliance experts; 24x7 managed detection and response; managed UTM firewall services; ASV vulnerability scanning; security penetration testing; PCI compliance programs and validation services; QSA and HIPAA assessments; and more, we’ve got your back. For more information visit ControlScan.com.

Press Contact
Stacey Holleran
Director, Corporate Communications
678-694-0654

Report: ISOs, Acquirers Finding Innovative Ways to Address Merchant PCI Compliance

Recent survey by ControlScan and the Merchant Acquirers’ Committee finds new strategies surrounding non-compliance fees, scope-reducing technologies.

LAS VEGAS, March 03, 2020 (GLOBE NEWSWIRE) -- MAC Level Up Conference - ControlScan, a leader in managed security and compliance solutions that help secure networks and protect payment card data, has released a new payments industry research report in collaboration with the Merchant Acquirers’ Committee (MAC). Among its findings, the ControlScan/MAC 2020 Acquiring Trends Report identifies new strategies ISOs, acquirers and other merchant service providers are employing in the face of increasing merchant PCI compliance challenges.

ControlScan and MAC have tracked various aspects of acquirers’ PCI programs—including who has them, their goals and achievements, and how they’re administered—since 2011. Gathering this data over time has provided the ability to follow trends and share unique insights into the state of merchant PCI compliance programs.

Acquiring Trends survey respondents consistently say that regular, ongoing communications and education are key to their merchant PCI compliance efforts. However, this year’s survey saw a rise (from 35% to 44%) in those who are realizing the benefit in combining communications with technology services such as managed firewall. Validated point-to-point encryption (P2PE) solutions, as well as end-to-end encryption (E2EE) also rated high for their ability to reduce PCI scope.

Chris Bucolo

"When combined with regular communications and educational content, scope-reducing technologies and related services are a powerful way to make life easier for the merchant,” said Chris Bucolo, Vice President of Market Strategy, ControlScan. “It’s all about giving the merchant the tools and support they need to properly secure their business, without overburdening them.”

Other key findings from the ControlScan/MAC 2020 Acquiring Trends Report include:

• Keeping merchants compliant is a continuing challenge – From 2014 through 2018, portfolio compliance rates were on a healthy upward trend. In 2018, however, there began to be signs of slowing rate growth based upon 38% of survey respondents reporting that their rates had either stayed the same or declined. The 2020 numbers show a definitive downward trend, with only 26% reporting compliance rates above 60% (as opposed to 42% in 2018) and 23% under 25% (as opposed to 15% in 2018).
• Non-compliance fees are increasing in their significance – The percentage of those not charging non-compliance fees has historically been stable at around 17-18%. This year, however, the percentage rose to 23%. When asked about the drivers behind waiving non-compliance fees, an astounding 77% said they did so for strategic and/or competitive purposes. This year’s survey also found a widening divide between those who charge no non-compliance fees and those who are charging a non-compliance fee of more than $50 per month.
• High Compliance Rates and merchant risk reduction go hand in hand – Keeping merchant risk in check is a priority for virtually all respondents, with 86% saying it’s a high or top business priority. Further data analysis revealed that one-third of those who have made merchant risk reduction a top priority are achieving higher merchant portfolio compliance rates than the group as a whole.

"Running a successful PCI compliance program requires regular reviews of metrics and trends so that corresponding adjustments can be made,” said Bucolo. “Like security technologies, there is no ‘set and forget’.”

“The information we glean from our ongoing survey partnership with ControlScan is extremely valuable,” said Vadeene Sisk, Education Committee Chair, MAC. “High merchant compliance rates translate to reduced business risk, which is mission critical for the MAC membership base as well as the payments community at large.”

About the Survey 
The ControlScan/MAC 2020 Acquiring Trends Survey was conducted over a six-week period between November 12 and December 23, 2019. The survey was administered online, and a link was distributed via email to randomly selected processors, acquirers, ISOs and other merchant service providers listed in the databases of ControlScan and MAC. A total of 68 payments industry professionals, representing organizations that serve Level 3 and 4 merchants, completed the survey.

The ControlScan/MAC 2020 Acquiring trends report is being released in conjunction with the MAC Level Up Conference taking place March 2-5 at the Park MGM in Las Vegas. Download a complimentary copy of the new report here.

About ControlScan 
ControlScan managed security and compliance solutions help secure IT networks and protect payment card data. Thousands of businesses throughout the U.S. and Canada partner with us for easy, cost-effective access to the expertise, technologies and services that keep cyber criminals and data thieves at bay. With highly credentialed cybersecurity and compliance experts; 24x7 managed detection and response; managed UTM firewall services; ASV vulnerability scanning; security penetration testing; PCI compliance programs and validation services; QSA and HIPAA assessments; and more, we’ve got your back. For more information visit ControlScan.com.

About Merchant Acquirers’ Committee (MAC)
The Merchant Acquirers’ Committee (MAC) is an organization of payments professionals dedicated to protecting the integrity of the payments ecosystem. Our members include acquiring banks, ISOs, the card brands, NACHA, law enforcement agencies, payment processors, and payment facilitators. MAC’s mission is to strengthen the payment ecosystem through ongoing education, communication, and cooperation among its members. For more information, visit www.macmember.org. 

Press Contact
Stacey Holleran
Director, Corporate Communications
678-279-2645
sholleran@controlscan.com

Friday Funny/Not Funny

(Click on comic for larger view.)

You don't want any Daves in your organization.  Check out ControlScan's Security Awareness Training solution today.  (Besides, Requirement 12.6 of the PCI Data Security Standard includes regular security education of your company's employees...)

Financial Services Firm Cutter, LLC Chooses ControlScan for Managed Security Threat Detection and Response

Cybersecurity risk reduction a prime motivator for Cutter, which holds multiple portfolios of small and mid-sized merchants.

ATLANTA, Dec. 11, 2019 (GLOBE NEWSWIRE) -- ControlScan, a leader in managed security services specializing in compliance, detection and response, has been chosen by Cutter to help the financial services firm reduce its cybersecurity risk. According to the newly signed agreement, ControlScan will provide Cutter with 24x7 threat detection and response as a managed security service.

According to the ControlScan 2019 Managed Detection and Response Report, IT teams spend an average of 40 hours per month monitoring endpoints and security logs. Because of this, 62 percent are at best only moderately confident in their ability to respond to a cyberattack. Cutter recognized its ability to reduce this risk in their own business by utilizing the ControlScan Managed Detection and Response (MDR) service.

“Cutter purchases portfolios and residual streams and manages every portfolio, each containing hundreds if not thousands of small and mid-sized merchants,” said Denise Shomo, President, Cutter, LLC. “ControlScan’s MDR service gives us confidence that qualified security analysts are watching our IT environment around the clock, ensuring that the data we’re entrusted with doesn’t fall into the wrong hands.”

“Cutter’s leadership team has taken the time to understand the business’s cybersecurity risk,” said Chris Bucolo, SVP Market Strategy, ControlScan. “Through this up-front investment, as well as implementing 24x7 threat detection and response, Cutter has proactively taken control of its security posture.”

The ControlScan MDR service leverages the company’s security operations center (SOC) and its proprietary SIEM platform, Cyphon, which captures and compiles data from both physical and digital sources. This elite combination of people, processes and technology provides Cutter with a managed security partnership they can rely on.

ControlScan is also a longtime PCI program partner for Cutter. Since 2010, ControlScan has helped thousands of merchants within Cutter’s portfolios achieve and maintain compliance with the Payment Card Industry Data Security Standard (PCI DSS).

For more information about ControlScan and its range of managed security services, please visit ControlScan.com/MSS.

About ControlScan
ControlScan managed security and compliance solutions help secure IT networks and protect payment card data. Thousands of businesses throughout the U.S. and Canada partner with us for easy, cost-effective access to the expertise, technologies and services that keep cyber criminals and data thieves at bay. With highly credentialed cybersecurity and compliance experts; 24x7 managed detection and response; managed UTM firewall services; ASV vulnerability scanning; security penetration testing; PCI compliance programs; QSA, QSA(P2PE), QPA and HIPAA assessments; and more, we’ve got your back. 

For more information visit ControlScan.com.

About Cutter, LLC
David Daily, CEO of Cutter, founded the company in 2006 with a primary focus of helping ISOs and merchant level sales (MLSs) leverage the value of their residual income streams. At the time, he saw an increased need to provide them with an avenue to sell their residuals. Originally based in Franklin, Tenn., Cutter has grown to 22 employees and is now headquartered in Wyomissing Pa., with branches in Birmingham, Ala., and Franklin. Since its inception, Cutter has completed hundreds of portfolio acquisitions and is now actively pursuing other types of purchases to include software companies with SaaS revenues and ISVs. 

For more information, visit Cutterfinancial.com.

ControlScan Press Contact
Stacey Holleran
Director, Corporate Communications
678-694-0654
sholleran@controlscan.com

Why ControlScan?

Trusted by more than 1.1 million companies around the world, the ControlScan difference is a unified approach to security and compliance, with a human face:

• We deliver security solutions that make compliance simple, and compliance solutions that guide your security strategies;
• Our team of security and compliance professionals is comprised of humans who understand that your business and its processes are unique; and
• Your business is supported by our organizational credentials, which include Qualified Security Assessor (QSA) and Approved Scanning Vendor (ASV), as well as individuals holding the latest certifications from organizations such as ISACA, Offensive Security, (ISC)2 CompTIA, EC- Council, GIAC, HIPAA Academy, and more.

ControlScan helps you cut through the complexity of securing sensitive data and achieving compliance, thereby eliminating guesswork and allowing you to focus on your business.

In other words, we've got your back.

ControlScan Managed Security and Compliance

Become a partner.  Contact me today.

A PaySafe Success Story from Skurla's Point of Sale Solutions

Check out the Skurla's blog here.

To learn more about ControlScan's security and compliance solutions

and our partnership program, contact me today.

IT leaders must find a way to place emphasis on security and compliance.

For many IT organizations, waste and frustration are the name of the game when it comes to facilitating compliance with industry standards like PCI DSS and HIPAA:

• Scoping headaches over the security "gray areas" of mobile and cloud;
• Political hassles over aligning the organization's business needs and its compliance requirements;
• Ongoing uncertainty over your team's ability to maintain a compliant business environment.

But who said it has to be this way?

The ControlScan white paper, "5 Critical IT Challenges You Can Solve Today," provides practical tips for making compliance suck less! In it, you'll learn how a managed UTM firewall service helps IT organizations overcome their biggest challenges—not the least of which is the compliance process.

If you'd like to discuss a way to resolve your compliance and security headaches this year, please contact me today. We're here to help.

Partnering with ControlScan

I am a ControlScan Channel Sales Manager based out of Atlanta, Georgia.

ControlScan offers solutions that protect networks and payment card data - everything from our security solutions like PaySafe Connect to our compliance services highlighted by our PCI 1-2-3 Self-Assessment…and much more.

If you are a POS VAR (or any provider) that serves SMB merchants who need affordable, easily-managed solutions for security and compliance, partnering with ControlScan would greatly benefit your customers.  And when your customers benefit – you benefit!

Click here to learn more about our partner program or contact me today to learn more about our solutions and our partner program.

Security and compliance start here! Partner with us today.

At ControlScan, we’ve got your back. ControlScan delivers security and compliance solutions that make it easy for merchants to secure sensitive data and achieve compliance. Our team of credentialed experts is highly responsive, so when they have questions, we’ll be there. By taking security and compliance off their plate, merchants can focus on what they do best – running their business!

Security and compliance start here. Our mission is to help businesses secure their networks, protect sensitive data, and achieve compliance. As a Managed Security Service Provider, our team becomes your customer’s team, enabling them to predict, protect, and defend against the latest security threats.  Every technology, service, and piece of advice we deliver helps merchants secure their business and achieve compliance.

At ControlScan, we have three pillars of our business:

·         World Class Service and Partnership Focus

o   “No Limits” Merchant Support Center

o   Thought Leadership Collaboration

o   Dedicated Success Manager Assigned to Enterprise Account

·         Multi-Layered Customization

o   Branding, Customized Communication, and Support Strategies

o   Simplified PCI Process for Merchants; Streamlined SAQ and Suppressed Questions

·         Enterprise-Class Security

o   One-Stop Shop for PCI Security and Compliance Delivering User-Friendly Experience

o   Merchant Access to Security Expertise and Consultative Services to Understand Options

ControlScan offers a wide breadth of services in three categories….

·         Managed Compliance Services

o   Customized SAQ Portal

o   ASV Scanning

o   Breach Protection

o   Market Strategy Consultation

o   Merchant Engagement Outreach

·         Managed Security Services

o   Unified Threat Management

o   Endpoint Security

o   Managed Detection and Response

o   Managed SIEM/FIM

o   Network Services

·         Security Consulting Services

o   Senior-Level PCI-Qualified Security Assessors on Staff

o   Network Penetration Testing

o   Risk Assessment

o   Report on Compliance (RoC)

Our partner program assists you in deploying security services...

• Path to Compliance:  Easier path to compliance for your merchants through scope reduction
• Speed to Market:  Increased speed to market with new products and services
• Upgrade Opportunities:  For merchants processing through antiquated terminals
• Limit Transaction Loss:  Limited transaction loss through up-time monitoring and fail-over internet connections.

As your partner, we are dedicated to your merchants….

• Merchant Support:  High-tough merchant support with goal of single call resolution
• Support and Access:  Scanning support and direct access to managed security service engineers
• Merchant Outreach:  Knowledgeable representatives continually trained to assist merchants to achieve compliance
• Onsite Contact Center:  High visibility with read access to executives and experts from corporate HQ in Atlanta, GA

Merchant Benefits:  Secure Network Design

Merchant Benefits:  Disciplined Management

ControlScan supports your merchants through the full network security lifecycle.  We offer comprehensive project management services including network design, deployment, installation, monitoring, upgrades, and ongoing maintenance of their network.  We ensure you merchants:

• Employ best practices
• Adopt the latest, best-in-breed technology
• Have access to security experts to manage, monitor, and maintain security on an ongoing basis

Merchant Benefits:  Ease of PCI Compliance

By utilizing PaySafe UTM, ConstrolScan assumes responsibility for requirements 1.1, 1.2, and 1.3 and the PCI DSS 12 Steps for Compliance.  When implemented in conjunction with the ControlScan SAQ Solution, assumed sections of compliance are automatically pre-populated to decrease the amount of time and effort to self-attest.

Check out the case study from Food Giant:  https://www.youtube.com/watch?v=N4C4Bm6qnVg

For more information on how partnering with ControlScan can greatly benefit your customers – and you – don’t hesitate to contact me today!