What is a QIR?

Does your company use a Qualified Integrator and Reseller, or QIR? You’re likely here because you’ve been asked that question on your PCI Self-Assessment Questionnaire and you have no idea what in the world a QIR is! ControlScan is here to help. By the end of the video below, you’ll know what a QIR is, why you need one, and how to make sure your business is using one.

Check out ControlScan's blog, PCI Compliance Guide, to learn more.

Security with a Purpose Podcast

ControlScan's Security with a Purpose is an information security podcast that takes an in-depth look at the various aspects of securing an organization.

Get tips, tricks and best practices from ControlScan experts to move purposefully toward stronger security and simplified compliance. Interviews by Jeff Wilder, Director of Risk & Compliance Management, ControlScan.

Check it out and subscribe today!

Apple Podcasts   |   Google Podcasts   |   Spotify   |   Stitcher

How companies can leverage point-to-point encryption (P2PE) to secure payments and to simplify the PCI compliance process.

Sam Pfanstiel, Director of Security Consulting Services at ControlScan, joined the Security with a Purpose podcast on May 19th, 2020 to discuss this hot topic.

Give it a listen here.

How ControlScan and Chesapeake Payment Systems Collaborated to Achieve a Mid-90s Portfolio Compliance Rate

Chesapeake Payment Systems Achieves Merchant Portfolio Compliance Goals with ControlScan.

Helpful tools, responsive service and simplified security make ControlScan a preferred partner. Read all about how it was done HERE.

Report: ISOs, Acquirers Finding Innovative Ways to Address Merchant PCI Compliance

Recent survey by ControlScan and the Merchant Acquirers’ Committee finds new strategies surrounding non-compliance fees, scope-reducing technologies.

LAS VEGAS, March 03, 2020 (GLOBE NEWSWIRE) -- MAC Level Up Conference - ControlScan, a leader in managed security and compliance solutions that help secure networks and protect payment card data, has released a new payments industry research report in collaboration with the Merchant Acquirers’ Committee (MAC). Among its findings, the ControlScan/MAC 2020 Acquiring Trends Report identifies new strategies ISOs, acquirers and other merchant service providers are employing in the face of increasing merchant PCI compliance challenges.

ControlScan and MAC have tracked various aspects of acquirers’ PCI programs—including who has them, their goals and achievements, and how they’re administered—since 2011. Gathering this data over time has provided the ability to follow trends and share unique insights into the state of merchant PCI compliance programs.

Acquiring Trends survey respondents consistently say that regular, ongoing communications and education are key to their merchant PCI compliance efforts. However, this year’s survey saw a rise (from 35% to 44%) in those who are realizing the benefit in combining communications with technology services such as managed firewall. Validated point-to-point encryption (P2PE) solutions, as well as end-to-end encryption (E2EE) also rated high for their ability to reduce PCI scope.

Chris Bucolo

"When combined with regular communications and educational content, scope-reducing technologies and related services are a powerful way to make life easier for the merchant,” said Chris Bucolo, Vice President of Market Strategy, ControlScan. “It’s all about giving the merchant the tools and support they need to properly secure their business, without overburdening them.”

Other key findings from the ControlScan/MAC 2020 Acquiring Trends Report include:

• Keeping merchants compliant is a continuing challenge – From 2014 through 2018, portfolio compliance rates were on a healthy upward trend. In 2018, however, there began to be signs of slowing rate growth based upon 38% of survey respondents reporting that their rates had either stayed the same or declined. The 2020 numbers show a definitive downward trend, with only 26% reporting compliance rates above 60% (as opposed to 42% in 2018) and 23% under 25% (as opposed to 15% in 2018).
• Non-compliance fees are increasing in their significance – The percentage of those not charging non-compliance fees has historically been stable at around 17-18%. This year, however, the percentage rose to 23%. When asked about the drivers behind waiving non-compliance fees, an astounding 77% said they did so for strategic and/or competitive purposes. This year’s survey also found a widening divide between those who charge no non-compliance fees and those who are charging a non-compliance fee of more than $50 per month.
• High Compliance Rates and merchant risk reduction go hand in hand – Keeping merchant risk in check is a priority for virtually all respondents, with 86% saying it’s a high or top business priority. Further data analysis revealed that one-third of those who have made merchant risk reduction a top priority are achieving higher merchant portfolio compliance rates than the group as a whole.

"Running a successful PCI compliance program requires regular reviews of metrics and trends so that corresponding adjustments can be made,” said Bucolo. “Like security technologies, there is no ‘set and forget’.”

“The information we glean from our ongoing survey partnership with ControlScan is extremely valuable,” said Vadeene Sisk, Education Committee Chair, MAC. “High merchant compliance rates translate to reduced business risk, which is mission critical for the MAC membership base as well as the payments community at large.”

About the Survey 
The ControlScan/MAC 2020 Acquiring Trends Survey was conducted over a six-week period between November 12 and December 23, 2019. The survey was administered online, and a link was distributed via email to randomly selected processors, acquirers, ISOs and other merchant service providers listed in the databases of ControlScan and MAC. A total of 68 payments industry professionals, representing organizations that serve Level 3 and 4 merchants, completed the survey.

The ControlScan/MAC 2020 Acquiring trends report is being released in conjunction with the MAC Level Up Conference taking place March 2-5 at the Park MGM in Las Vegas. Download a complimentary copy of the new report here.

About ControlScan 
ControlScan managed security and compliance solutions help secure IT networks and protect payment card data. Thousands of businesses throughout the U.S. and Canada partner with us for easy, cost-effective access to the expertise, technologies and services that keep cyber criminals and data thieves at bay. With highly credentialed cybersecurity and compliance experts; 24x7 managed detection and response; managed UTM firewall services; ASV vulnerability scanning; security penetration testing; PCI compliance programs and validation services; QSA and HIPAA assessments; and more, we’ve got your back. For more information visit ControlScan.com.

About Merchant Acquirers’ Committee (MAC)
The Merchant Acquirers’ Committee (MAC) is an organization of payments professionals dedicated to protecting the integrity of the payments ecosystem. Our members include acquiring banks, ISOs, the card brands, NACHA, law enforcement agencies, payment processors, and payment facilitators. MAC’s mission is to strengthen the payment ecosystem through ongoing education, communication, and cooperation among its members. For more information, visit www.macmember.org. 

Press Contact
Stacey Holleran
Director, Corporate Communications
678-279-2645
sholleran@controlscan.com

Friday Funny/Not Funny

(Click on comic for larger view.)

You don't want any Daves in your organization.  Check out ControlScan's Security Awareness Training solution today.  (Besides, Requirement 12.6 of the PCI Data Security Standard includes regular security education of your company's employees...)

Financial Services Firm Cutter, LLC Chooses ControlScan for Managed Security Threat Detection and Response

Cybersecurity risk reduction a prime motivator for Cutter, which holds multiple portfolios of small and mid-sized merchants.

ATLANTA, Dec. 11, 2019 (GLOBE NEWSWIRE) -- ControlScan, a leader in managed security services specializing in compliance, detection and response, has been chosen by Cutter to help the financial services firm reduce its cybersecurity risk. According to the newly signed agreement, ControlScan will provide Cutter with 24x7 threat detection and response as a managed security service.

According to the ControlScan 2019 Managed Detection and Response Report, IT teams spend an average of 40 hours per month monitoring endpoints and security logs. Because of this, 62 percent are at best only moderately confident in their ability to respond to a cyberattack. Cutter recognized its ability to reduce this risk in their own business by utilizing the ControlScan Managed Detection and Response (MDR) service.

“Cutter purchases portfolios and residual streams and manages every portfolio, each containing hundreds if not thousands of small and mid-sized merchants,” said Denise Shomo, President, Cutter, LLC. “ControlScan’s MDR service gives us confidence that qualified security analysts are watching our IT environment around the clock, ensuring that the data we’re entrusted with doesn’t fall into the wrong hands.”

“Cutter’s leadership team has taken the time to understand the business’s cybersecurity risk,” said Chris Bucolo, SVP Market Strategy, ControlScan. “Through this up-front investment, as well as implementing 24x7 threat detection and response, Cutter has proactively taken control of its security posture.”

The ControlScan MDR service leverages the company’s security operations center (SOC) and its proprietary SIEM platform, Cyphon, which captures and compiles data from both physical and digital sources. This elite combination of people, processes and technology provides Cutter with a managed security partnership they can rely on.

ControlScan is also a longtime PCI program partner for Cutter. Since 2010, ControlScan has helped thousands of merchants within Cutter’s portfolios achieve and maintain compliance with the Payment Card Industry Data Security Standard (PCI DSS).

For more information about ControlScan and its range of managed security services, please visit ControlScan.com/MSS.

About ControlScan
ControlScan managed security and compliance solutions help secure IT networks and protect payment card data. Thousands of businesses throughout the U.S. and Canada partner with us for easy, cost-effective access to the expertise, technologies and services that keep cyber criminals and data thieves at bay. With highly credentialed cybersecurity and compliance experts; 24x7 managed detection and response; managed UTM firewall services; ASV vulnerability scanning; security penetration testing; PCI compliance programs; QSA, QSA(P2PE), QPA and HIPAA assessments; and more, we’ve got your back. 

For more information visit ControlScan.com.

About Cutter, LLC
David Daily, CEO of Cutter, founded the company in 2006 with a primary focus of helping ISOs and merchant level sales (MLSs) leverage the value of their residual income streams. At the time, he saw an increased need to provide them with an avenue to sell their residuals. Originally based in Franklin, Tenn., Cutter has grown to 22 employees and is now headquartered in Wyomissing Pa., with branches in Birmingham, Ala., and Franklin. Since its inception, Cutter has completed hundreds of portfolio acquisitions and is now actively pursuing other types of purchases to include software companies with SaaS revenues and ISVs. 

For more information, visit Cutterfinancial.com.

ControlScan Press Contact
Stacey Holleran
Director, Corporate Communications
678-694-0654
sholleran@controlscan.com

[Webinar] Sharing Responsibilities: Applicability of PCI DSS Requirements for Merchants and MNSPs

Register now to attend this November 21st Conexxus webinar by ControlScan's Sam Pfanstiel.

Using third-party services providers (TPSPs) to help meet security goals and compliance requirements is an effective way to leverage collective strengths and allow the merchant to focus on its core business. One common TPSP in the fuel retail industry is the managed network service provider (MNSP), which provides technology, service and expertise to support secure network configuration and operation for convenience stores and other fuel services.  Nonetheless, it is the merchant who must ultimately demonstrate that all applicable security and PCI DSS compliance requirements are being met and doing so may be very confusing without a good understanding how these requirements apply to these entities.

In this session, Sam Pfanstiel will review common PCI DSS controls for MNSPs and other TPSPs, how to confirm that your selected vendor is meeting these controls on your behalf, and a review of requirements that must be met by the merchant to confirm and enforce this delegated security relationship.  In addition to gaining a better understanding of these service providers as they relate to PCI DSS, attendees of this webinar will also learn what questions must be asked, what agreements must be in place, and which specific artifacts must be collected in order to clearly delineate responsibility for and compliance with PCI for their business.

       

ControlScan QSA Services Help Church Community Builder Stay PCI Compliant

Well, my last post didn't age well, as my Yankees have been eliminated. :-(

But, on a much happier note, ControlScan is pleased to share this success story:  How ControlScan Helps a High-Transaction, Cloud-Based Software Company Stay PCI Compliant Year after Year.

Contact me today to see how ControlScan can help you with your PCI compliance needs!

ControlScan Partners with FIS to Streamline Payment Facilitators’ PCI Compliance

Two leaders in payment facilitator services—ControlScan and Worldpay from FIS—join forces to reduce security risk in the payments chain.

ATLANTA, Sept. 10, 2019 (GLOBE NEWSWIRE) -- ControlScan, a leader in managed security and compliance solutions that help secure IT networks and protect payment card data, has been selected by FIS’ merchant services division, Worldpay from FIS*, to provide services that will help reduce payment security risk for payment facilitators the company serves.

As a payment service provider for its payment facilitator clients, FIS will employ ControlScan’s platform to assist payment facilitators on the path to compliance with the Payment Card Industry Data Security Standard (PCI DSS). ControlScan’s platform enhances the Worldpay from FIS solution suite to simplify the complexity and increased scope of compliance inherent in the payment facilitator business model.

“Payment facilitators provide a valuable service within the payments chain, but there can be security-related risks inherent in that model,” said Nicole Jass, senior vice president of product, merchant services, FIS. “We are partnering with ControlScan to proactively address those risks and deliver a platform to our payment facilitators that is specific to their method of payment acceptance.”

Through the new partnership, payment facilitators using Worldpay from FIS solutions can leverage the customized ControlScan platform to put their sub-merchants on a path to compliance with PCI DSS. Payment facilitators can also take advantage of ControlScan’s PCI Qualified Security Assessors (QSAs) to conduct a formal IT risk assessment as well as become ControlScan certified as a PCI DSS Level 1 Service Provider.

When payment facilitators take advantage of this offering, payment security risk can be reduced at multiple points in the payments chain. The payment facilitator and the end merchant will both benefit from an increase in compliance and a decrease in risk.

“In recent years we’ve seen aggressive growth in the payment facilitation segment of the payments industry,” said Matt Loos, executive vice president of business development, ControlScan. “We are excited to partner with FIS and are looking forward to guiding payment facilitators through a best-practices approach for maintaining their own compliance and security, as well as that of their sub-merchants.”

For more information about ControlScan and its full range of managed security and compliance solutions, please visit ControlScan.com.
 

 
*The Worldpay from FIS solution suite is part of the FIS Merchant Solutions business, which serves merchants and eCommerce providers around the world. FIS acquired Worldpay on July 31, 2019.

About FIS
FIS is a global leader in technology, solutions and services for merchants, banks and capital markets businesses. We drive growth for clients by creating tomorrow’s technology, solutions and services to modernize today’s businesses and customer experiences. FIS applies our scale, deep expertise and data-driven insights to advance the way the world pays, banks and invests. We help our clients innovate with purpose and deliver experiences that are more simple, seamless and secure. Headquartered in Jacksonville, Florida, FIS employs 55,000 people worldwide who are dedicated to helping our clients solve for the future. FIS is a Fortune 500® company and is a member of Standard & Poor’s 500® Index. To learn more, visit www.fisglobal.com. Follow FIS on Facebook, LinkedIn and Twitter (@FISGlobal).

About ControlScan                                                 
ControlScan managed security and compliance solutions help secure IT networks and protect payment card data. Thousands of businesses throughout the U.S. and Canada partner with us for easy, cost-effective access to the expertise, technologies and services that keep cyber criminals and data thieves at bay. With highly credentialed cybersecurity and compliance experts, 24x7 managed detection and response, advanced endpoint protection, managed UTM firewall services, ASV vulnerability scanning, QSA and HIPAA assessments, security penetration testing, PCI compliance programs and more, we’ve got your back. For more information visit ControlScan.com.

ControlScan Press Contact
Stacey Holleran
Director, Corporate Communications
678-694-0654

Why ControlScan?

Trusted by more than 1.1 million companies around the world, the ControlScan difference is a unified approach to security and compliance, with a human face:

• We deliver security solutions that make compliance simple, and compliance solutions that guide your security strategies;
• Our team of security and compliance professionals is comprised of humans who understand that your business and its processes are unique; and
• Your business is supported by our organizational credentials, which include Qualified Security Assessor (QSA) and Approved Scanning Vendor (ASV), as well as individuals holding the latest certifications from organizations such as ISACA, Offensive Security, (ISC)2 CompTIA, EC- Council, GIAC, HIPAA Academy, and more.

ControlScan helps you cut through the complexity of securing sensitive data and achieving compliance, thereby eliminating guesswork and allowing you to focus on your business.

In other words, we've got your back.

Meet your security and compliance challenges head on.

Do you find it difficult to continuously manage security risk and PCI compliance across your business network?  Are you looking for a single vendor to provide an effective strategy to address security and compliance?  If so, you're certainly not alone.

ControlScan has worked with numerous retail, convenience store, restaurant, and hospitality chains to implement programs that resolve their data security and PCI compliance challenges, such as:

• One IT team managing multiple independent franchise locations
• Stores with their own unique network infrastructures and/or payment systems
• A business growth strategy that is introducing network complexity and potential cyber risk
• Lack of network segmentation and/or controls, which can be easily exploited by hackers

Let's talk at RetailNOW!

Visit me at Booth 443 or email me and let's talk about how a ControlScan partnership can supply the manpower and expertise that meets your security and compliance challenges head on.

Who is ControlScan?

ControlScan managed security and compliance solutions help secure IT networks and protect payment card data. Thousands of businesses throughout the U.S. and Canada partner with us for easy, cost-effective access to the expertise, technologies, and services that keep cyber criminals and data thieves at bay. We have highly credentialed cybersecurity and compliance experts, 24x7 managed detection and response, advanced endpoint protection, managed UTM firewall services, ASV vulnerability scanning, QSA and HIPAA assessments, security penetration testing, PCI compliance programs and more!

To learn more, don't hesitate to contact me directly. Or, if you prefer, you can click here to schedule some time on my calendar.

At ControlScan, we've got your back!

Is your company protected?

Your company's networks are being probed, prodded and possibly attacked countless times every day. Unless you're monitoring your logs, you're likely unaware all this actvity is taking place. Awareness is a critical element of an effective defense.

Are you aware of your security shortcomings?

A Network and Application Layer Penetration Test simulates a real-world attack against your network infrastructure and information systems in order to see how far an attacker would actually be able to progress within your cardholder data environment. In short, penetration tests expose holes in your defense.

Do you need a Pen Test?

If you think you may need a pen test — or aren't sure — give me a call! I'd be happy to answer any questions you have. In the meantime, ControlScan subject matter experts have put together helpful information:

• Learn about penetration tests in this blog post by industry expert Chris Bucolo;
• Read how SaaS company QuickSilk confirmed their security posture through a ControlScan penetration test; and
• Watch this to learn how to select the right penetration testing service company.

Contact me today to learn more.

ControlScan Managed Security and Compliance

Become a partner.  Contact me today.

A PaySafe Success Story from Skurla's Point of Sale Solutions

Check out the Skurla's blog here.

To learn more about ControlScan's security and compliance solutions

and our partnership program, contact me today.

Are you a POS reseller? An MSP?

Learn how partnering with ControlScan can provide additional value for your client and differentiate/reinforce your brand - thereby increasing client "stickiness" and reducing churn. Contact me today.

Partnering with ControlScan

I am a ControlScan Channel Sales Manager based out of Atlanta, Georgia.

ControlScan offers solutions that protect networks and payment card data - everything from our security solutions like PaySafe Connect to our compliance services highlighted by our PCI 1-2-3 Self-Assessment…and much more.

If you are a POS VAR (or any provider) that serves SMB merchants who need affordable, easily-managed solutions for security and compliance, partnering with ControlScan would greatly benefit your customers.  And when your customers benefit – you benefit!

Click here to learn more about our partner program or contact me today to learn more about our solutions and our partner program.

Increase your marketplace reach and merchant stickiness with high-value managed security and compliance services.

The ContolScan POS Reseller, ISV and MSP Partnership Program

Partner with a cybersecurity industry leader.

ControlScan has served as a security and compliance program partner to the payments industry since 2007. Over the years, we've earned the trust of organizations like yours to become a leader in delivering comprehensive solutions to merchants' PCI and cybersecurity-related challenges.

Here are just a few ways ControlScan differentiates itself in the marketplace:

• User-Friendly Technology: We design and build solutions that help merchants make sense of their PCI obligations and what they must do to meet them, as well as how to increase their overall security posture.
• Security-as-a-Service: Our managed security services provide easy access to innovative, best-of-breed security solutions that also satisfy specific PCI DSS requirements.
• Award-Winning Support: Our highly-trained teams of security experts and compliance support professionals provide a responsive, engaging customer experience that creates long-term success and loyalty.
• Deep-Seated Expertise: We possess a depth and breadth of expertise that makes our managed security, PCI-QSA and security testing services second to none.

Merchants rely on their service providers for guidance and technology solutions to make their lives easier. Partnering with ControlScan solves your merchants' security and compliance challenges, adding tremendous value to the relationship you share.

Provide high-value managed security and PCI compliance services.

At its core, your business may be about increasing merchant engagement, driving sales or ensuring business continuity. You don't want to specialize in security and compliance any more than your merchants do! However, as a POS reseller, ISV or MSP, your business is in a unique position to provide these high-value services.

ControlScan partnerships bring together PCI compliance programs and managed security services to deliver a win-win scenario for your business and the merchants it serves:

• Easier security and compliance for them = Increased customer retention for you
• ControlScan-driven support for them = Less support time and dedicated resources for you
• Single-source product/service access for them = Additional installation income for you
• Plus, your business gets residual income on all ControlScan referrals

Let's talk.

Ready to discuss how a ControlScan partnership can benefit your POS reseller, ISV or MSP business?  Contact me today.

Partner with ControlScan

If your business serves SMB merchants that need affordable, easily-managed solutions for security and compliance, partnering with ControlScan would greatly benefit your customers.  And when your customers benefit – you benefit!

ControlScan offers a wide range of solutions, from our compliance services highlighted by our PCI 1-2-3 Self-Assessment to our security solutions like PaySafe Connect…and much more.

Contact me today to learn more about our solutions and our channel partner program.