The Payment Card Industry Data Security Standard (PCI DSS) is an essential security standard that ensures the safety of card-based transactions. Instituted in 2004, it is a joint venture by top credit card companies such as Visa, MasterCard, Discover Financial Services, JCB International, and American Express. This guide aims to provide a comprehensive understanding of PCI DSS, its compliance levels, requirements, benefits, and the best practices to ensure compliance.
Overview of PCI DSS
PCI DSS is administered and managed by the Payment Card Industry Security Standards Council (PCI SSC). Its primary objective is to enhance the security of debit and credit card transactions, safeguarding sensitive data against fraud and theft. Although the PCI SSC does not have legal authority to enforce compliance, it is mandatory for businesses involved in credit or debit card transactions. PCI certification is also viewed as a reliable way to protect sensitive data, thereby building long-lasting, trusting relationships with customers.
The Importance of PCI DSS Compliance
Businesses that do not adhere to PCI DSS compliance risk damaging their reputation and incurring significant financial losses. A data breach that reveals sensitive customer information can result in severe penalties, including fines from payment card issuers, lawsuits, diminished sales, and substantial reputation damage. Therefore, businesses must take data security seriously and invest in PCI security procedures to ensure the safety of their commerce from malicious online actors.
PCI DSS Certification
PCI DSS certification guarantees the security of card data within your business. The PCI SSC establishes these requirements, which include commonly known best practices such as firewalls installation, data encryption during transmissions, and the use of anti-virus software. Businesses also need to restrict access to cardholder data and monitor access to network resources.
PCI DSS Compliance Levels
PCI compliance is categorized into four levels, depending on the annual number of credit or debit card transactions a business processes. The classification level determines what an enterprise needs to do to remain compliant.
- Level 1: For merchants processing more than six million real-world credit or debit card transactions annually. These merchants must undergo an internal audit once a year and a PCI scan by an Approved Scanning Vendor (ASV) once a quarter.
- Level 2: For merchants processing between one and six million real-world credit or debit card transactions annually. They are required to complete an annual assessment using a Self-Assessment Questionnaire (SAQ) and may also need a quarterly PCI scan.
- Level 3: For merchants processing between 20,000 and one million e-commerce transactions annually. They must complete an annual assessment using the relevant SAQ and may also require a quarterly PCI scan.
- Level 4: For merchants processing fewer than 20,000 e-commerce transactions annually, or those that process up to one million real-world transactions. They must complete a yearly assessment using the relevant SAQ and may also require a quarterly PCI scan.
Key Requirements of PCI DSS
The PCI SSC has outlined 12 key requirements for maintaining a secure network and handling cardholder data. These requirements, distributed among six broader goals, are essential for an enterprise to become PCI DSS compliant.
- Secure Network: A firewall configuration must be installed and maintained, and system passwords must be original (not vendor-supplied).
- Secure Cardholder Data: Stored cardholder data must be protected, and transmissions of cardholder data across public networks must be encrypted.
- Vulnerability Management: Anti-virus software must be used and regularly updated. Secure systems and applications must be developed and maintained.
- Access Control: Cardholder data access must be restricted to a business need-to-know basis. Every person with computer access must be assigned a unique ID, and physical access to cardholder data must be restricted.
- Network Monitoring and Testing: Access to cardholder data and network resources must be tracked and monitored. Security systems and processes must be regularly tested.
- Information Security: An information security policy must be maintained.
Web Application Firewalls and PCI Compliance
Since its inception, PCI DSS has undergone several updates to keep up with the evolving online threat landscape. One significant addition was Requirement 6.6, introduced in 2008, which focuses on securing data against common web application attack vectors.
Businesses can satisfy this requirement either through application code reviews or by implementing a web application firewall (WAF). A cloud-based WAF, such as the one offered by Imperva, can be configured and ready to use within minutes, effectively safeguarding against application layer attacks and ensuring PCI DSS compliance.
The Role of PCI DSS
The PCI DSS applies to any organization, regardless of size or number of transactions, that accepts, transmits, or stores any cardholder data. All merchants fall into one of four merchant levels based on Visa transaction volume over a 12-month period. The transaction volume is based on the aggregate number of Visa transactions (inclusive of credit, debit, and prepaid) from a merchant Doing Business As (‘DBA’).
Steps to Achieve PCI Compliance
To satisfy the requirements of PCI, a merchant must complete the following steps:
- Determine Appropriate SAQ: Determine which Self-Assessment Questionnaire (SAQ) your business should use to validate compliance.
- Complete SAQ: Complete the SAQ as per the instructions it contains.
- Vulnerability Scan: Complete and obtain evidence of a passing vulnerability scan with a PCI SSC Approved Scanning Vendor (ASV).
- Complete Attestation of Compliance: Complete the relevant Attestation of Compliance in its entirety (located in the SAQ tool).
- Submit Compliance Documentation: Submit the SAQ, evidence of a passing scan (if applicable), and the Attestation of Compliance, along with any other requested documentation, to your acquirer.
Responsibility for PCI Compliance
Even if you use a third-party company, this does not exempt your company from PCI DSS compliance. Although this may reduce your risk exposure and the effort to validate compliance, it does not mean you can ignore the PCI DSS. It is crucial to familiarize yourself with your merchant account agreement, which should outline your exposure.
Penalties for Non-Compliance
Non-compliance with the PCI DSS can result in penalties from the payment brands. These may range from $5,000 to $100,000 per month. Banks will likely pass this fine along until it eventually hits the merchant. The bank may also terminate your relationship or increase transaction fees.
Securing Cardholder Data
Securing cardholder data is a continuous process that involves prevention, detection, and appropriate reaction to security incidents. Businesses need to regularly evaluate their security posture to quickly find areas that need attention, prioritize them, and mitigate risks to an acceptable level.
Conclusion
In conclusion, PCI DSS is an essential standard for businesses dealing with credit or debit card transactions. By adhering to its guidelines, businesses can ensure the security of their card transactions, build customer trust, and safeguard their reputation. Regular audits, employee training, and investing in the right security measures are crucial for achieving and maintaining PCI DSS compliance.
Centralisera Limited is PCI DSS Level 1 certified.