Service Provider Levels for CISP Compliancy

For service providers that process, store, or transmit Visa cardholder data on behalf of Visa members, merchants, or other service providers, there are three levels of compliance validation.

Service Level One

• All VisaNet processors (member and nonmember) and all payment gateways.

Service Level Two

• Any service provider that is not in Level 1 and stores, processes, or transmits more than 1,000,000 Visa accounts/transactions annually.

Service Level Three

• Any service provider that is not in Level 1 and stores, processes, or transmits less than 1,000,000 Visa accounts/transactions annually.

In addition to their CISP compliance validation responsibilities, a service provider must also be registered as an Agent with a sponsoring Visa member.

Loud CISP recommends ControlScan for CISP compliance.

Merchants also have different levels as well.

		Compliance Actions	Validation Actions
Group	Level	Comply with PCI Data Security Standards	On-Site Security Audit	Self-Assessment Questionnaire	Network Scan
Merchant	1	Required	Required Annually		Required Quarterly
	2 &3	Required		Required Annually	Required Quarterly
	4	Required		Recommended Annually	Required Quarterly
Service Provider	1	Required	Required Annually		Required Quarterly
	2	Required	Required Annually		Required Quarterly
	3	Required		Required Annually	Required Quarterly