Attachment 1 Verizon Gap Analysis.pdf

This document is Attachment 1 to a PCI DSS Advisory Consultant RFI Q&A, containing a Verizon Gap Analysis that outlines a prioritized approach for achieving PCI DSS compliance. The document presents six milestones in descending order of priority.

The milestones are structured as follows: (1) Remove sensitive authentication data and limit data retention as highest priority, (2) Protect systems/networks and prepare for breach response, (3) Secure payment card applications, (4) Monitor and control system access, (5) Protect stored cardholder data, and (6) Finalize remaining compliance efforts as lowest priority. Each milestone includes specific objectives - for example, Milestone 1 focuses on reducing risk by eliminating unnecessary sensitive data storage, while Milestone 4 establishes controls for tracking who accesses network and cardholder data environments. This appears to be a reference document that would inform the broader PCI DSS advisory consulting services being sought by the Air Force Services Center.