PCI DSS Compliance

Have you ever wondered (or worried) about what happens to payment card data once a purchase is made? Probably not. The reason? We can attribute the safety of cardholder data to our unsung hero – PCI DSS, safeguarding the data – or so you’d hope. Are you PCI DSS compliant?

Here’s everything you need to know about PCI DSS, what it means for your business, and what you need to do to comply with its requirements. But first, let’s start with introductions.

WHat is pci dss?

Introducing the Payment Card Industry Data Security Standard, or PCI DSS for short. To fully understand the framework, it’s important to take a step back to where it all started. In 2004, all five major credit card companies decided to join forces and use their powers for good. Together they created The PCI Security Standards Council (PCI SSC). Their mission? To create a set of security standards for organizations that process payment information, specifically cardholder data. And without further ado, they created a security standard known as - you guessed it - PCI DSS.

pci dss In A nutshell

PCI DSS focuses on three main components:

Handling access to credit card data to protect sensitive card details when collected and transmitted.

Establishing the 12 security domains within the PCI standard to ensure data is stored securely.

Annual validations (forms, questionnaires, external vulnerability scans, or third-party audits) to ensure the security controls are still in place.

The PCI DSS Bible

Everything to know about securing payments and cardholder data

Do you need to be PCI DSS compliant?

The big question is, who does PCI DSS apply to, and does your business need to comply with PCI requirements? Here’s the deal: PCI DSS compliance is required from any merchant or service provider that comes into contact with cardholder data, whether processing, transmitting, or storing. Although PCI DSS compliance is not mandated by law, it is still contractually required between credit brands and those handling cardholder data.

Types of organizations that must comply are:

The 12 security requirements of PCI DSS compliance

The PCI SSC developed and maintained twelve high-level requirements that guide PCI DSS compliance. These requirements are all critical security controls, and businesses are expected to implement them in order to protect credit card data. Implementing and maintaining the twelve requirements is also a prerequisite in order to get (and stay) compliant. The twelve requirements are then further broken into six control objectives, as seen in the table below:

1. Develop and maintain a secure network to ban unauthorized access to cardholder data.

Install the relevant web filters or firewalls to protect cardholder data.

Update and change all default security settings of configurations.

2. Protect CHD if stored locally or transmitted to a remote server or service provider.

Safeguard company servers or networks that come into contact with CHD.

Use encryption when transmitting CHD across public networks.

3. Create and maintain a vulnerability management program that includes security procedures, policies, internal controls, and penetration testing.

Install and manage up-to-date antivirus and malware software.

Use secure protocols in all systems and applications.

4. Implement strong access control measures on a need-to-know basis.

Restrict access to cardholder data by a need-to-know basis.

Restrict access to cardholder data to authenticated users.

5. Continuously monitor and test physical and wireless networks to find and remediate vulnerabilities.

Limit physical access to cardholder data through physical hardware and devices.

Monitor all access to network resources and especially cardholder data.

6. Maintain a strong information security policy and inform employees about their responsibilities to protect CHD.

Evaluate and test the effectiveness of existing security systems and processes.

Maintain a policy that addresses information security.

PCI DSS Compliance Levels

Which level are you at?

Level 1

Merchant Criteria:

You process more than 6,000,000 Visa transactions per year.

You’ve had a data breach or attack that resulted in an account data compromise.

You’re identified as level 1 by any card association.

Validation Requirements:

An Annual Report on Compliance by a Qualified Security Assessor.

Quarterly network scan by an Approved Scanning Vendor (ASV).

An Attestation of Compliance Form.

Merchant Criteria:

You process more than 6,000,000 Visa transactions per year.
You’ve had a data breach or attack that resulted in an account data compromise.
You’re identified as level 1 by any card association.

Validation Requirements:

An Annual Report on Compliance by a Qualified Security Assessor.
Quarterly network scan by an Approved Scanning Vendor (ASV).
An Attestation of Compliance Form.

Level 2

Merchant Criteria:

You’re within the threshold of 1 million – 6 million Visa or MasterCard transactions annually (all channels).