PCI DSS
Payment Card Industry Data Security Standard
A security standard for protecting payment card data. Start by identifying your payment channels and the systems, people and providers involved.
PCI DSS KNOWLEDGE FOR TRAVEL AGENTS
Understand PCI DSS before your assessment.
PCI DSS, sometimes searched as PCIDSS, connects payment security with assessment evidence. This guide explains SAQ, ROC, AOC and QSA in the context of travel agencies.
Five terms that help you plan.
SAQ
Self-Assessment Questionnaire
A questionnaire for reporting self-assessment results. Eligibility depends on your payment environment; confirm the appropriate SAQ with the entity accepting your compliance evidence.
ROC
Report on Compliance
A detailed report of PCI DSS assessment results. Whether a ROC or an SAQ is required is determined by the entity accepting compliance evidence, such as an acquirer or payment brand.
AOC
Attestation of Compliance
The official form used to attest to assessment results documented in an SAQ or ROC. The applicable form and signatories depend on the assessment.
QSA
Qualified Security Assessor
A qualified assessor working within a PCI SSC-qualified QSA company. Confirm assessment scope and the required reporting approach before starting.
PAYMENTS & TRAVEL
PCI DSS, IATA and BSP.
BSP is the IATA framework for sales reporting, remittance and settlement between accredited travel agents and airlines. PCI DSS compliance is a condition for agents to obtain and maintain permission to use the Customer Card Payment Method in BSP.
Review your actual card-handling process and the evidence requested by IATA or the relevant compliance-accepting entity. Your reporting obligations depend on your business and payment arrangements.
Read IATA guidance for travel agents →Prepare your agency for the next step.
Map payment channels
Identify card data flows, systems and service providers.
Confirm the reporting route
Clarify SAQ eligibility or ROC requirements with the party accepting your evidence.
Organize evidence
Use PCISURE to organize responses, evidence and training records.
Review and follow up
Coordinate with reviewers and follow assessment outcomes and applicable AOC records.
PCISURE supports assessment preparation and review workflows for travel agents. A full ROC engagement and its deliverables require a separately agreed scope; using the platform does not automatically establish compliance.
Official reference material
Plan your PCI DSS assessment with ALPHASEC.
Discuss your travel agency’s scope, evidence and review needs.