Experian Independent Third-Party Assessment (EI3PA) is the annual security assessment required when third parties access, transmit, store, or process credit reports and other regulated data from Experian. Gaining access to Experian’s credit reports, APIs, and consumer data used in identity verification and credit checks requires completion of EI3PA. To become compliant, companies must have their information security systems, policies, and procedures annually evaluated by an independent assessor to ensure they meet the guidelines and requirements. EI3PA provides Experian with the assurance that its technical providers have implemented the necessary and reasonable security safeguards to protect consumer information.
EI3PA requires an evaluation of a third party’s information security program and controls by an independent assessor based on requirements provided by Experian. Many of the security controls are similar to PCI DSS requirements, but there are additional unique requirements, including multifactor authentication and external vulnerability scans that companies must submit on a quarterly basis.
While EI3PA security control requirements are adapted from PCI DSS requirements, they are not the same. EI3PA is designed to protect Experian data, not credit card data. Many of the security controls are similar, but there are additional unique requirements, including multifactor authentication and external vulnerability scans that companies must submit on a quarterly basis.
It doesn’t take long to set up a project with a third party that has already achieved EI3PA compliance. For example, Very Good Security (VGS) has been audited by an independent EI3PA Qualified Security Assessor (QSA) and achieved EI3PA compliance certification. By layering VGS around your systems, you can achieve EI3PA compliance quickly and minimize both development costs and security risks. VGS provides full audit support from compliance and engineering teams throughout the compliance life cycle.
© 2021 Very Good Security - All Rights Reserved Terms - Privacy Notice