How often is a service provider assessed?

Every year. A service provider handling significant volumes submits a Report on Compliance and an Attestation of Compliance signed by a Qualified Security Assessor annually. Between assessments it runs quarterly external scans by an Approved Scanning Vendor, authenticated internal scans, penetration tests at least once a year and segmentation tests every six months.

The annual cycle

A service provider that handles significant card volumes, typically Level 1, is assessed every year by a Qualified Security Assessor. The result is a Report on Compliance and an Attestation of Compliance, which acquirers and customers can request. Smaller providers may self-assess with a questionnaire, depending on their acquirer's rules.

Between assessments

• Quarterly external vulnerability scans by an Approved Scanning Vendor.
• Authenticated internal vulnerability scans at the same rhythm.
• Penetration tests at least once a year and after significant changes.
• Segmentation tests every six months for service providers.
• Continuous logging, monitoring and review of access.

What operators should ask their providers

The date of the last Attestation of Compliance, the assessor, and the scope it covers. An attestation that excludes the services the operator uses is not evidence. Operators building on a validated infrastructure should keep the provider's attestation on file and align their own assessment calendar with it, so the two documents tell a consistent story when an acquirer asks.