Maintaining PCI Compliance when Using Multiple Processors

Originally published by TokenEx.

Written by Anni Burchfiel.

Compliance with PCI DSS 4.0 (the Payment Card Industry Data Security Standard) is a necessary, but complicated, part of accepting payments for your business. Any system that processes or stores cardholder data, including third-party payment processors, must be PCI compliant. Whether you’ve recently started using multiple payment processors or have used multiple processors for years, you may wonder if there’s a way to simplify the process.

We’re here to reassure you: maintaining PCI compliance with multiple processors is easier once you understand a few basics. This blog will walk you through everything you need to know about PCI compliance and give you the tools you need to simplify your next PCI audit.

Quick Hits:

• PCI compliance is a set of security standards created by major card brands and designed to protect cardholder data.
• The solution to simplifying PCI compliance with multiple processors is reducing the number of systems that hold and process cardholder data.
• Tokenization enables companies to own their cardholder data without storing it internally, decreasing PCI scope and simplifying multi-processor management and PCI compliance.

What is PCI Compliance?

The Payment Card Industry Data Security Standard (PCI DSS) is a set of twelve security standards set by major credit card companies. These standards protect cardholders by regulating the use and storage of cardholder data. Adhering to these standards not only enables merchants to use major card brands but also provides a rigorous checklist by which to examine security measures. PCI-compliant merchants improve their security and brand reputation as these industry best practices are proven to reduce data breaches.

While PCI compliance is not required by law, it is required for merchants who want to use major card brands. Merchants that do not comply can be subject to fines ranging from $5,000 to $500,000. In severe cases, a merchant may lose their ability to accept payments at all.

The Basics of PCI Compliance for Multi-Processor Businesses

Every system that stores, processes, or transmits cardholder data must meet the rigorous requirements of PCI DSS. As a merchant, you are responsible for ensuring that all your internal systems meet PCI DSS requirements and that any third parties you work with (like payment processors) are also PCI compliant. The more systems that come into contact with payment card data, the heavier your PCI Compliance burden will become.

In some cases, using third-party processors can cut down on the efforts a merchant must make to ensure that they are PCI compliant. The PCI burden the merchant is responsible for will depend on the processors they use and the way they utilize those processors. We’ll get into the best way to utilize multiple processors and reduce scope in a minute, but first, we need to understand the basic requirements of PCI Compliance.

An overview of the requirements for PCI compliance are as follows:

• Install and maintain a firewall configuration to protect cardholder data
• Do not use vendor-supplied defaults for system passwords and other security parameters
• Protect stored cardholder data
• Encrypt transmission of cardholder data across open, public networks
• Use and regularly update anti-virus software or programs
• Develop and maintain secure systems and applications
• Restrict access to cardholder data by businesses need to know
• Assign a unique ID to each person with computer access
• Restrict physical access to cardholder data
• Track and monitor all access to network resources and cardholder data
• Regularly test security systems and processes
• Maintain a policy that addresses information security for all personnel

If you’re looking for a more in-depth explanation of these requirements, check out our PCI DSS checklist here. For the purposes of this blog, you just need to know that every system that interacts with payment card data must adhere to the above rules.

When you use multiple processors, tracking all the systems that encounter cardholder data can get complicated quickly. To maintain compliance, you must verify that both your internal systems and your processors are handling cardholder data in a way that meets all the requirements of PCI DSS.

As your company scales, your PCI audit can become a logistical nightmare that consumes weeks of your team’s time. Thankfully, there’s a way to simplify your compliance and reduce your PCI scope.

The Best Way to Maintain PCI Compliance with Multiple Processors

Managing your company’s PCI scope is the secret to meeting all the requirements of PCI DSS while reducing the burden of compliance and easily utilizing multiple processors.

A company’s PCI scope varies based on the number of systems, and third parties, that hold that data. Every system that touches cardholder data must follow all twelve PCI requirements and be audited to ensure they meet those requirements. The more systems cardholder data touches, the tougher PCI compliance is to verify and maintain. The solution to simplifying PCI compliance comes from limiting the number of systems that hold and process cardholder data.

This can be difficult if you use multiple processors since their individual requirements can reduce your flexibility to decide what happens with your data. When your PSPs gather and store cardholder data for you, they maintain tight control over that data and can charge thousands of dollars if you want to utilize it yourself or transfer to another processor. These PSP issues, and more, can be solved by owning your data.

When you transfer your cardholder data away from your PSP, you control how it’s stored, accessed, and utilized. While this may seem like a counterintuitive step towards reducing your PCI scope, owning your data does not have to transfer the cardholder data into your internal systems. There is one tool that lets you own your cardholder data, without bringing it into PCI scope: tokenization.

What if, instead of tracking every system and processor that encounters cardholder data and subjecting it to rigorous annual audits, cardholder data was instead captured at the moment of entry and stored in a single location? Suddenly, instead of juggling multiple processors and systems for compliance, the burden of PCI compliance is neatly transferred to one third-party security system. This simplification is possible with tokenization.

Tokenization will swap the original cardholder data for placeholder tokens that can be used in internal systems and to transact will all your payment processors. Since these tokens are not subject to PCI DSS, the burden of PCI compliance is transferred to the tokenization solution you choose. Using a tokenization provider replaces the need to audit multiple third-party vendors and numerous internal systems. When you tokenize your data with a PCI-certified tokenization company, you can maintain PCI compliance with multiple processors easily.