In 2020, credit card and debit card frauds resulted in total losses amounting to $266 million. In addition, credit card fraud is the second most common type of identity theft reported. Any organization that accepts digital transactions, stores, processes, or transmits payment information has a huge target on its back as financially motivated cybercriminals are always looking for soft targets for financial fraud. No matter how large or how small a business is, it can become the target of cyber attacks resulting in data breaches and loss of sensitive financial data.
In 2020, credit card and debit card frauds resulted in total losses amounting to $266 million.
Tweet this!
To ensure the security of consumer financial information from payment card transactions businesses, banks, and other financial institutions need to work together using standard security procedures and technologies. And that is where the Payment Card Industry (PCI) Data Security Standard (DSS) comes into the picture.
PCI DSS aims at addressing the vulnerabilities and risks associated with financial data security. It sets comprehensive requirements for enhancing payment account data security to alleviate the vulnerabilities and protect cardholder data from financial fraud. This article is a quick-start guide to PCI DSS compliance, its requirements, security controls, processes, and steps to prepare your IT systems for compliance.
This guide answers the following questions about PCI DSS compliance:
1. What Is PCI DSS?
The PCI DSS (Payment Card Industry Data Security Standard) is a set of information security standards for helping companies that accept, process, store, or transmit credit card information maintain a secure environment. The goal of PCI DSS is to secure credit and debit card transactions against data theft and fraud by increasing security controls around cardholder data.
PCI DSS was formed in 2004 by a consortium consisting of Visa, MasterCard, Discover Financial Services, JCB International, and American Express. It is administered by the Payment Card Industry Security Standards Council (PCI SSC), an independent body created by the payment card consortium. Today, PCI DSS is used by all organizations such as merchants, banks, processors, etc. that handle card payments from the major credit card brands.
A copy of the PCI DSS document can be accessed at the PCI Security Standards Council document library.
2. To Whom Does PCI DSS apply?
PCI DSS applies to all organizations that store, process, or transmit cardholder data. Examples include merchants, banks, processors, etc. However, the actual validation of the compliance is only necessary if the annual transactions exceed a set threshold. In addition, compliance validation also depends on factors such as place of business and type of payment cards accepted since each of the founding members has its own specific requirements.
3. Is PCI DSS Mandatory?
Compliance with PCI DSS standards is not required of businesses by governments and the PCI SSC has no legal authority to compel compliance. However, the card companies that control these standards may impose fines against organizations that do not comply.
In any case, getting the PCI certification is a great way to safeguard sensitive data and it helps businesses demonstrate their commitment to customer data security, thereby building trust.
4. What Happens If A Business Is Not PCI Compliant?
Penalties for PCI compliance violations are not openly discussed or published. And since, the PCI SSC has no legal authority to compel compliance, the penalties are not imposed directly on businesses. So, at their discretion, the card companies fine the banks for PCI compliance violations. The fines can range from $5,000 to $100,000 per month. The banks may pass on the fine until it reaches the merchant, increase transaction fees, or even terminate relationships with the violating business.
5. What Does PCI DSS Cover?
As mentioned above, PCI DSS applies to all organizations that handle card data, which may be in any form including printed, over the phone, in person, or online. These standards cover the following information:
Cardholder data including the cardholder’s name, primary account number, card expiration date, and security codes.
Authentication data such as those contained in magnetic stripes, chips, and PINs.
PCI DSS provides a comprehensive framework for protecting payment card data from loss and misuse while it is collected, stored, processed, and transmitted. PCI DSS compliance ensures that the processes and systems that merchants use to protect card data meet accepted standards. In addition, these standards also help organizations mitigate vulnerabilities in card readers, point of sale systems, databases, call recording software, and online portals.
6. What Are The PCI Compliance ‘Levels’?
PCI defines four compliance levels based on the transaction volume over a twelve-month period. The volume is based on the aggregate number of transactions including credit, debit, and prepaid cards.
Here are the levels as defined by Visa:
|
Levels |
Description |
|
1 |
Any merchant that processes over 6M Visa transactions per year. |
|
2 |
Any merchant processing 1M to 6M Visa transactions per year. |
|
3 |
Any merchant processing 20,000 to 1M Visa e-commerce transactions per year. |
|
4 |
Any merchant processing fewer than 20,000 Visa e-commerce transactions per year, and all other merchants processing up to 1M Visa transactions per year. |
7. What Are The Requirements Of PCI DSS Compliance?
PCI DSS consists of twelve requirements aimed at six security goals:
|
Goals |
PCI DSS Requirements |
|
Build and Maintain a Secure Network |
1. Install and maintain a firewall configuration to protect cardholder data. |
|
Protect Cardholder Data |
3. Protect stored cardholder data. |
|
Maintain a Vulnerability Management Program |
5. Use and regularly update anti-virus software or programs. |
|
Implement Strong Access Control Measures |
7. Restrict access to cardholder data by business need-to-know. |
|
Regularly Monitor and Test Networks |
10. Track and monitor all access to network resources and cardholder data. |
|
Maintain an Information Security Policy |
12. Maintain a policy that addresses information security for employees and contractors. |
8. How Do You Comply With PCI DSS?
Each card brand has specific requirements for compliance validation and reporting depending on the compliance level and risk classification as determined by the individual card brand.
Nevertheless, the compliance process usually follows the following five-step process:
1. Scoping
Determining the systems governed by PCI DSS.
2. Sampling
Examining for compliance a subset of the systems in scope
3. Compensating Controls
Validation of alternative controls and processes by the Qualified Security Assessor (QSA)
4. Reporting
Submission of required documentation
5. Clarifications
If applicable, providing clarification for or updates to report statements upon bank request.
9. How To Prepare Your IT Systems For PCI DSS Compliance?
From an information technology perspective, the following best practices will set you on the right track to achieving PCI DSS compliance.
1. Secure Your Network
Building and maintaining a secure network is the first goal of PCI DSS compliance. Anyone who has access to your network or WiFi also has access to your entire infrastructure and more importantly to your customer data. Therefore, protecting your network is your first priority. To help you get started, here’s a handy Network Security Checklist.
To further improve your network infrastructure security, you can refer to the network security tools and best practices shared in the following articles:
2. Implement Data Security Best Practices
The primary goal of PCI DSS is to secure credit and debit card transactions against data theft and fraud. So it is only natural that data security receives high importance. An organization’s ability to demonstrate effective data security measures is a critical requirement not only for PCI but also for other regulations such as CCPA, HIPAA, etc.
To help you improve your organization’s data security, refer to the following articles that share data security best practices:
3. Ensure Endpoint Security
Use of up-to-date antivirus software and maintenance of secure applications and endpoints is another key requirement of PCI compliance. An antivirus serves as the first line of defense that protects your weakest link i.e. those employees who do things that the IT team tells them to avoid.
Be it for endpoint protection or for meeting compliance requirements, using antivirus software is a must for businesses. However, choosing the right antivirus presents a challenge in itself. Thankfully, to help you make an informed decision, we have shared what you need to look for in an antivirus in our article: How To Choose The Best Antivirus For Your Security.
4. Implement Identity And Access Management
The implementation of strong access control measures is another requirement of PCI compliance. In today’s complex technology landscape consisting of diverse applications, technologies, and systems, identifying, authenticating, and authorizing employees and contractors who access the company’s IT resources is very challenging.
Thankfully, Identity and Access Management (IAM) systems provide a solution to the problem of ensuring appropriate access to IT resources. IAM solutions reduce the complexities of access management across multiple applications, reduce the cost of access management, and make it easier to meet compliance requirements.
Once the IAM system is in place, your organization can further strengthen its security by implementing the Zero Trust security model, which is an ideal security architecture for cloud-first and mobility-driven modern businesses. It promotes mutual authentication irrespective of the location, and grants access privileges based on device identity and device health.
5. Create A Robust IT Policy
Maintaining an information security policy is another key requirement of PCI compliance. The policy must inform employees as well as contractors of their expected duties related to information security. To achieve PCI DSS compliance, organizations must establish, publish, maintain, and disseminate a security policy that addresses all PCI DSS requirements.
The IT policy document must also include an annual process for identifying vulnerabilities and formally assessing risks. Demonstrating the risk assessment and management processes will be easier if your organization already has an IT Risk Management process in place. To achieve compliance, organizations are required to conduct reviews at least once a year and when the business environment changes.
Conclusion
Although the PCI DSS is a security standard for enhancing payment account data security, it consists of mostly security best practices, many of which are widely used. This makes the standard a framework for the protection of not just cardholder data but also other sensitive business data.
Achieving PCI DSS compliance sets the organization on track to achieve other regulatory compliance standards such as CCPA, HIPAA, etc. Therefore, investing in shoring up IT security is definitely worth it not just for compliance but also for the overall security and sustainability of the organization.
Is your organization looking to achieve and maintain PCI DSS compliance? Partnering with a trusted IT company will ensure that your IT systems are in good health and able to meet rigorous compliance requirements. Click the button below to reach out to us and learn how we can help your organization achieve and maintain compliance on schedule and within budget.
If you liked the blog, please share it with your friends
About The Author
Hari SubediMarketing Manager at Jones IT
Hari is an online marketing professional with a focus on content marketing. He writes on topics related to IT, Security, Small Business, and Mindfulness. He is also the founder and managing director of Girivar Kft., a business services company located in Budapest, Hungary.