Certified Payment-Card Industry Security Auditor

Last updated

Certified Payment-Card Industry Security Auditor(CPISA) is an independent payments industry certification governed by the Society of Payment Security Professionals (commonly known as the SPSP). The CPISA focuses on information technology, information security, and auditing knowledge and skills. This certification is held by members from diverse backgrounds including Level 1 - 4 Merchants, Acquirers, Issuers, QSAs, Processors, Gateways, Service Providers, Consultants, and Auditors. All CPISA holders are members of the SPSP and also hold the CPISM certification.

Contents

Certification Knowledge Domains

The CPISA curriculum covers subject matter in a variety of Information Security and Payments Industry topics. The CPISA examination is based on what a collection of topics relevant to payment industry security professionals. The CPISA Knowledge Domains establishes a common framework of payment industry terms and definitions that allow security professionals to discuss and debate matters pertaining to the profession with a common understanding.

The CPISA Knowledge Domains are: [1]


Requirements

Candidates for the CPISA must meet several requirements: [1]

Reference Documents

The SPSP provides several reference documents for studying and preparing for the CPISA certification:

See also

Related Research Articles

Professional certification, trade certification, or professional designation, often called simply certification or qualification, is a designation earned by a person to assure qualification to perform a job or task. Not all certifications that use post-nominal letters are an acknowledgement of educational achievement, or an agency appointed to safeguard the public interest.

<span class="mw-page-title-main">Tokenization (data security)</span> Concept in data security

Tokenization, when applied to data security, is the process of substituting a sensitive data element with a non-sensitive equivalent, referred to as a token, that has no intrinsic or exploitable meaning or value. The token is a reference that maps back to the sensitive data through a tokenization system. The mapping from original data to a token uses methods that render tokens infeasible to reverse in the absence of the tokenization system, for example using tokens created from random numbers. A one-way cryptographic function is used to convert the original data into tokens, making it difficult to recreate the original data without obtaining entry to the tokenization system's resources. To deliver such services, the system maintains a vault database of tokens that are connected to the corresponding sensitive data. Protecting the system vault is vital to the system, and improved processes must be put in place to offer database integrity and physical security.

CISSP is an independent information security certification granted by the International Information System Security Certification Consortium, also known as ISC2.

The Certified Financial Planner certification is a professional certification mark for financial planners conferred by the Certified Financial Planner Board of Standards in the United States, and by 25 other organizations affiliated with the Financial Planning Standards Board (FPSB), the owner of the CFP mark outside of the United States. The certification is generally considered the gold standard in the financial planning industry. The certification is managed by the Certified Financial Planner Board of Standards, Inc., which was founded in 1985 as a 501(c)(3) non-profit organization; it is neither a government designation nor an accredited degree.

The Certified Fraud Examiner (CFE) is a credential awarded by the Association of Certified Fraud Examiners (ACFE) since 1989. The ACFE association is a provider of anti-fraud training and education. Founded in 1988 by Dr. Joseph T Wells. The ACFE established and administers the Certified Fraud Examiner (CFE) credential.

The Linux Professional Institute Certification (LPIC) Program is the core certification program offered by the Linux Professional Institute (LPI). LPI offers three different certification tracks: an introductory Essentials Track, the Linux Professional Track, and an Open Technology Track for professionals working with additional technologies such as DevOps and BSD.

<span class="mw-page-title-main">Certification</span> Formal confirmation of certain characteristics of an object, person or organization

Certification is part of testing, inspection and certification and the provision by an independent body of written assurance that the product, service or system in question meets specific requirements. It is the formal attestation or confirmation of certain characteristics of an object, person, or organization. This confirmation is often, but not always, provided by some form of external review, education, assessment, or audit. Accreditation is a specific organization's process of certification. According to the U.S. National Council on Measurement in Education, a certification test is a credentialing test used to determine whether individuals are knowledgeable enough in a given occupational area to be labeled "competent to practice" in that area.

Red Hat, an IBM subsidiary specializing in computer software, offers different level of certification programs, most of which specialize in system administration. Certifications can be validated through Red Hat webpage, and expire after 3 years.

Cisco Certifications are the list of the Certifications offered by Cisco Systems. There are four to five levels of certification: Associate (CCNA/CCDA), Professional (CCNP/CCDP), Expert (CCIE/CCDE) and recently, Architect, as well as nine different paths for the specific technical field; Routing & Switching, Design, Industrial Network, Network Security, Service Provider, Service Provider Operations, Storage Networking, Voice, Datacenter and Wireless.
There are also a number of specialist technicians, sales, Business, data center certifications and CCAI certified instructors.

The Oracle Certification Program certifies candidates on skills and knowledge related to Oracle products and technologies.

<span class="mw-page-title-main">Standard of Good Practice for Information Security</span>

The Standard of Good Practice for Information Security (SOGP), published by the Information Security Forum (ISF), is a business-focused, practical and comprehensive guide to identifying and managing information security risks in organizations and their supply chains.

The Payment Card Industry Data Security Standard is an information security standard used to handle credit cards from major card brands. The standard is administered by the Payment Card Industry Security Standards Council, and its use is mandated by the card brands. It was created to better control cardholder data and reduce credit card fraud. Validation of compliance is performed annually or quarterly with a method suited to the volume of transactions:

Following is a partial list of professional certifications in financial services, with an overview of the educational and continuing requirements for each; see Professional certification § Accountancy, auditing and finance and Category:Professional certification in finance for all articles. As the field of finance has increased in complexity in recent years, the number of available designations has grown, and, correspondingly, some will have more recognition than others. Note that in the US, many state securities and insurance regulators do not allow financial professionals to use a designation — in particular a "senior" designation — unless it has been accredited by either the American National Standards Institute or the National Commission for Certifying Agencies.

Certified Payment-Card Industry Security Manager(CPISM) is an independent payments industry certification governed by the Society of Payment Security Professionals (commonly known as the SPSP). The CPISM is the de facto certification for payment security professionals. This certification is held by members from diverse backgrounds including Level 1 - 4 Merchants, Acquirers, Issuers, QSAs, Processors, Gateways, Service Providers, and Consultants. All CPISM holders are members of the SPSP.

Qualified Security Assessor (QSA) is a designation conferred by the PCI Security Standards Council to those individuals that meet specific information security education requirements, have taken the appropriate training from the PCI Security Standards Council, are employees of a Qualified Security Assessor (QSA) company approved PCI security and auditing firm, and will be performing PCI compliance assessments as they relate to the protection of credit card data.

Forensic accountants are experienced auditors, accountants, and investigators of legal and financial documents that are hired to look into possible suspicions of fraudulent activity within a company; or are hired by a company who may just want to prevent fraudulent activities from occurring. They also provide services in areas such as accounting, antitrust, damages, analysis, valuation, and general consulting. Forensic accountants have also been used in divorces, bankruptcy, insurance claims, personal injury claims, fraudulent claims, construction, royalty audits, and tracking terrorism by investigating financial records. Many forensic accountants work closely with law enforcement personnel and lawyers during investigations and often appear as expert witnesses during trials.

The Computing Technology Industry Association, more commonly known as CompTIA, is an American non-profit trade association that issues professional certifications for the information technology (IT) industry. It is considered one of the IT industry's top trade associations.

Ukrainian Processing Center is a Ukrainian company founded in 1997 which provides processing services and software for banks. UPC was the first Ukrainian company within the sphere of processing that received MSP and TPP status in Visa and Mastercard. In April 1997 UPC processed the first ATM EC/MC card transaction. Since 2005 UPC has become part of the Raiffeisen Bank International. The head office of UPC is based in Kyiv. Ukrainian Processing Center provides services to banks in Central and East Europe in the sphere of processing payment cards, merchant acquiring and ATM channel management. UPC also offers integrated IT systems for electronic commerce, card transactions monitoring systems of fraud prevention, card issuing system and SMS banking service. Moreover, UPC was the initiator of the establishment of the united ATM network "ATMoSphere", which consists of payment cards issuing banks. Annually UPC processes more than 400 million of payment card transactions.

Point-to-point encryption (P2PE) is a standard established by the PCI Security Standards Council. Payment solutions that offer similar encryption but do not meet the P2PE standard are referred to as end-to-end encryption (E2EE) solutions. The objective of P2PE and E2EE is to provide a payment security solution that instantaneously converts confidential payment card data and information into indecipherable code at the time the card is swiped, in order to prevent hacking and fraud. It is designed to maximize the security of payment card transactions in an increasingly complex regulatory environment.

Certified Payment-Card Industry Security Implementer (CPISI) is a certification in the field of Payment Card Industry Data Security Standard.

References