Developing COVID-19 Outbreak Communication and Adjustment to Planned Assessment Activities

To Coalfire Clients:

As the coronavirus outbreak continues and safety concerns relating to travel, and large meeting groups increase globally, Coalfire’s Payments Assurance Practice has been monitoring the effect of this crisis on both its customers and its employees. As a Qualified Security Assessor Company (QSAC), Coalfire maintains certifications with the PCI Security Standards Council (PCI SSC). Our remote assessment approach is intended to follow a “safety first” mindset, but also ensure compliance deadlines are not put at risk. Coalfire has been in communication with the PCI SSC via recent Global Executive Assessor Roundtable (GEAR) meetings and has received guidance around this developing, worldwide event and have released guidance pertaining to COVID-19 referenced below.

• PCI Security Standards - Covid-19
• Remote Assessments and the Coronavirus
• How the PCI DSS Can Help Remote Workers
• Protecting Payments While Working Remotely

As a response to these events and current guidance, Coalfire will be taking the following steps effective immediately for all PCI assessments, where onsite assessment reviews are planned or expected:

1. Coalfire has developed an alternative approach to performing onsite (physical) assessment activities through a combination of remote web-conference / video recording with onsite staff, as well as collection of supporting evidence (log outputs, access lists, video / photos, etc).
2. At the discretion of both the appointed PCI Director and the assessed client, the option to revise the walkthrough activities from an onsite assessment to a remote assessment, via methods outlined above (#1), are now permissible.
3. At the discretion of both the appointed PCI Director and the assessed client, assessment schedules may be extended, where remote assessment options are deemed to be nonviable. Coalfire will support the assessed client in discussions with acquirers to ensure necessary compliance extensions can be achieved.

To participate in these revised assessment procedures, we are asking our customers to proactively contact your Lead Assessor, assigned PCI Director, or assigned Project Manager to coordinate any revised assessment schedules and adjustments to onsite activities.

At the core of this bulletin, we want to communicate a message of safety and solidarity, recognizing that the full extent of this global event is still unknown. Our wish for all of our customers and staff is to alleviate concerns relating to compliance deadlines during this difficult time, provide remote assessment guidance, including alternative approaches to evidence collection and observations, and to continue to anticipate the needs of our interested parties as we work together through these global events.