Privacy and Data Protection

PCI DSS is a set of security standards established to safeguard payment card information and prevent unauthorized access. Developed by major credit card companies, including Visa, MasterCard, and American Express, the standard aims to create a secure environment for processing, storing, and transmitting cardholder data. Read our blog “Understanding PCI DSS: A Guide to the Payment Card Industry Data Security Standard.”

There are multiple benefits of a PCI DSS audit, including protecting your customer data, building stakeholder trust, meeting business requirements, and avoiding fines and penalties. With BARR’s PCI DSS compliance services, you can rest assured that your organization will meet compliance requirements.

PCI DSS applies to all entities that store, process, and/or transmit cardholder data. If your organization accepts or processes payment cards, you must comply with PCI DSS. Depending on your organization’s needs, BARR’s PCI DSS compliance solutions include PCI DSS reports on compliance (RoC), PCI DSS attestations of compliance (AoC), and QSA-assisted self-assessment questionnaires (SAQs).

BARR’s attest services team has developed a proven process that makes completing a PCI DSS compliance audit simple. It begins with a planning stage, where you’ll work with our team to set expectations and determine the scope of the engagement. Next, your auditor will assess your organization’s cardholder data environment (CDE), including completing policy reviews, system evidence reviews, and interviews with your team. When the assessment period ends, you will either complete a QSA-assisted self-assessment questionnaire (SAQ), or receive a PCI DSS report on compliance (RoC) or PCI DSS attestation of compliance (AoC) from BARR on the results of the audit.

With BARR’s PCI DSS compliance solutions, our PCI DSS auditors help organizations prepare for and successfully achieve PCI DSS compliance seamlessly within three to six months, depending on the client’s needs and the PCI DSS services they are utilizing.

While PCI DSS is not a legal requirement, it is mandated by the PCI Security Standards Council. If your organization stores, processes, and/or transmits cardholder data, you are likely required to comply with PCI DSS.

There are multiple benefits to achieving a CSA STAR certification or a CSA STAR attestation. In addition to providing assurance to your customers and stakeholders, CSA STAR can help your organization achieve compliance with other powerful compliance frameworks and can differentiate your organization as one that takes cloud security seriously.

Achieving a CSA STAR certification or a CSA STAR attestation is a great choice for any cloud service provider looking to provide an extra level of assurance to their customers and stakeholders.

When CSA STAR is added to an ISO engagement, the result is a CSA STAR certification. When CSA STAR is added to a SOC 2 engagement, the result is a CSA STAR attestation. Speak to one of BARR’s CSA STAR auditors today to learn more about the right path for your organization.

The type(s) of data your organization processes will determine the scope of your assessment.

Microsoft Personal Data means any Personal Data processed by or on behalf of Microsoft and includes any information referring to a data subject, such as:

• Sensitive data
• Customer content data
• Captured and generated data
• Account data

Microsoft Confidential Data includes any data which, if compromised, could result in financial or reputational loss for Microsoft, such as:

• Information on the development, testing, or manufacturing of Microsoft products
• Microsoft pre-release marketing information
• Microsoft product license keys

Microsoft suppliers are required to submit evidence of compliance with the following regulations that make up Microsoft DPR:

• Management
• Notice
• Choice and Consent
• Collection
• Retention
• Data Subjects
• Disclosure to Third Parties
• Quality
• Security
• Monitoring and Enforcement

The length of time it takes to complete a readiness assessment and audit varies from company to company and depends on a variety of factors, including the size of the company, the complexity of the organization, and its current security posture. If a company already has a SOC 2 report, the assessment period will be quicker. For a new BARR client without a SOC 2 report, it typically takes one month to complete the readiness assessment, two to three months to complete the needed requirements, and one month for BARR to complete the independent assessment over the DPR.

Privacy is a major component of Microsoft DPR, making it an excellent framework for organizations to work toward control coverage of the GDPR. Compliance with Microsoft DPR can provide organizations with internal assurance that they are meeting many of the GDPR requirements they may be subject to. As part of our readiness assessment, BARR can also map controls and identify gaps between the DPR requirements and other frameworks, too.

Multiple controls overlap with coverage under ISO 27001, ISO 27077, and the DPR. In some cases, Microsoft will allow suppliers subject to the DPR to substitute the independent assessment over the DPR for ISO 27001 and 27077 certifications.