PCI Compliance Explained - Secure Your Credit Card Information Successfully

Originally published by BARR Advisory.

Written by Kyle Cohlmia.

According to the 2023 Verizon Data Breach Investigations Report (DBIR), financial motive was the motivation for 95% of the past year’s data breaches. In today’s business world, it only takes the tap of a card or click of a button to process customer payments—and with any type of financial transaction lies the opportunity for cardholder data theft. No matter the size of your organization, if you store, process, or transmit credit card information, you’ll want to comply with the Payment Card Industry Data Security Standard (PCI DSS) in order to avoid hefty fines and most importantly, keep your customer’s data secure.

PCI DSS is a framework which serves as a baseline of protection for consumers, helping to reduce fraud and data breaches throughout the entire payment process. PCI DSS compliance involves three main components:

• Handling customer credit card data from start to finish. More specifically, making sure that sensitive card details are collected and transmitted securely.
• Storing data securely as outlined by the 12 security domains of the PCI DSS standard, such as encryption, ongoing monitoring, and security testing of access to cardholder data.
• Validating that required security controls are in place on an annual basis. This can include security questionnaires, external vulnerability scanning services, and third-party audits.

PCI DSS Compliance Merchant Levels

PCI DSS was established by the major credit card companies, Visa, Mastercard, Discover, American Express, and JCB. While each company originally established their own merchant levels, recently the brands made it easier to understand which level your organization falls under—no matter which card brands you accept.

The general merchant levels are as follows:

• Level 1: Merchants processing over 6 million card transactions per year.
• Level 2: Merchants processing 1 to 6 million transactions per year.
• Level 3: Merchants handling 20,000 to 1 million transactions per year.
• Level 4: Merchants handling fewer than 20,000 transactions per year.

12 Requirements of PCI DSS Compliance

Protecting customer data is at the core of PCI DSS. There are twelve requirements each organization must meet in order to achieve compliance:

1. Install and maintain a firewall configuration to protect cardholder data.
2. Do not use vendor-supplied defaults for system passwords and other security parameters.
3. Protect stored cardholder data.
4. Encrypt transmissions of cardholder data across open, public networks.
5. Use and regularly update anti-virus software or programs.
6. Develop and maintain secure systems and applications.
7. Restrict access to cardholder data by business need to know.
8. Assign a unique ID to each person with computer access.
9. Restrict physical access to cardholder data.
10. Track and monitor all access to network resources and cardholder data.
11. Regularly test security systems and processes.
12. Maintain a policy that addresses information security for all personnel.

How to Prepare for PCI DSS Compliance

During the readiness assessment, prepare by assessing your controls prior to your onsite assessment. Here are a few tips to ensure your PCI assessment goes smoothly:

Understand Your Cardholder Data Environment (CDE)

Understanding your CDE is often referred to as “requirement zero.” Maintain current network diagrams that reflect how data is transmitted, processed, and stored to ensure your assessment goes smoothly.

Understand Your Requirements

Are you a service provider or a merchant? Protect yourself from last-minute surprises by recognizing any specific requirements that may apply to your organization.

Know Your Transaction Amount

Organizations are held accountable on the number of transactions handled annually. Prepare for your audit by having these numbers readily accessible.

No matter your organization’s merchant level and number of annual transactions, the security of your customer’s data is a critical—if not the most important step in establishing and growing your business.