Internal PCI audit system

Project Specification: Internal PCI Audit System

Overview:
The Internal PCI Audit System is a software application designed to facilitate the monthly internal audit of various departments within an organization. The system will provide personalized audit sheets to each department, which will be used to assess their compliance with the Payment Card Industry Data Security Standards (PCI DSS). The system will enable departmental readiness evaluation through conformance/non-conformance questions and ratings. Additionally, the system will generate a dashboard that provides a comprehensive overview of internal audits and departmental status.

Functional Requirements:

Departmental Audit Sheets:
The system will provide monthly personalized audit sheets to the following departments:
• HR
• Production
• Warehouse
• IT
• Maintenance
• Security
• Logistic
Each audit sheet will contain a set of conformance/non-conformance questions specific to the department being audited.
Departmental Readiness Evaluation:
The system will allow auditors to rate the department based on the conformance/non-conformance questions answered in the audit sheet. The rating will determine the department's readiness level in terms of PCI DSS compliance.

Dashboard:
The system will generate a dashboard in Excel format that will provide a comprehensive overview of the internal audit status. The dashboard will contain the following information:
• The readiness level displayed of each department expressed as a percentage.
• The number of internal audits performed in each department.
• Non-conformance status, including the number of non-conformances detected and their severity.

User Access Control:
The system will have user access controls that will ensure that only authorized personnel can access the audit sheets and the dashboard.

Data Management:
The system will store all audit data in a secure database that can only be accessed by authorized personnel.

Notification System:
The system will have a notification system that will send alerts to auditors and department heads when audit sheets are ready for completion or when non-conformance issues are detected.

Non-functional Requirements:

Security:
The system will be designed with security in mind, and all data will be stored securely to prevent unauthorized access or data breaches.

Usability:
The system will be user-friendly and intuitive, with clear instructions and easy navigation.

Scalability:
The system should be designed to accommodate growth, with the ability to add new departments or audit questions as required.

Reliability:
The system should be reliable and available at all times to ensure that audits can be completed in a timely manner.

Conclusion:
The Internal PCI Audit System is a vital tool for any organization that handles payment card data. The system will provide a streamlined approach to internal audits, enabling organizations to monitor and improve their PCI DSS compliance. By implementing this system, organizations can reduce their risk of data breaches, improve their reputation, and avoid costly fines for non-compliance.

info on PCI
https://www.pcisecuritystandards.org/