Frequently Asked Questions

When Do You Need a PCI PFI Investigation?

Payment card brands will sometimes require an independent investigation by a PCI PFI when a large amount of credit card fraud is tied to a single merchant ID, an indication of a possible breach.

Organizations must act quickly and work with a PCI forensic investigator to determine things such as:

• If a breach has occurred
• When it occurred
• What data was compromised
• The root cause of the attack
• Whether the breach has been contained
• Whether appropriate remediation steps have occurred
• What security improvements need to be made
• What PCI issues need to be addressed

What's involved in the PCI PFI Investigation?

In the simplest of terms, here are 6 key stages to a PCI PFI investigation:

• Determine the Scope
  The investigation starts by determining what components of the IT environment are affected.
• Acquire Electronic Data
  The investigator acquires and preserves evidence using a formal and documented process that is admissible in a court of law.
• Conduct Preliminary Analysis & Interviews
  The investigator conducts forensic analysis and interviews to thoroughly understand the sequence of events that took place before, during and after the incident.
• Prepare Initial Report
  No later than 5 business days after beginning the engagement, a preliminary investigation report must be provided to the PCI Council and major credit card brands with initial observations and findings.
• Document Findings
  The PFI uses various techniques to independently determine the root cause of the breach, ensure it has been contained, and recommend security improvements to help prevent future attacks. The PFI also tests whether required PCI security controls are in place and operating as intended.
• The Final Report
  Using a PCI Security Council report template, the PFI documents the forensic findings and any compliance gaps that caused or contributed to the breach. Before the report is finalized, the PFI meets with the major credit card brands and the impacted entity to present the findings and answer any questions. The goal is to ensure the breach has been contained and steps taken to improve compliance and security controls.