What Is Attestation of Compliance (AoC) and Why Does It Matter?

Originally published by TokenEx here.

Written by Valerie Hare, Content Marketing Specialist, TokenEx.

Did you know that a Verizon Payment Security Report found that only 27.9 percent of organizations achieved full compliance with PCI DSS during their validation process in 2019? The Payment Card Industry Data Security Standard (PCI DSS) is a security standard established by the major card brands to help organizations that process, store, or transmit card data maintain secure payment environments and protect cardholder data. While cybersecurity risks and attacks continue to rise, these merchants still struggle to meet PCI DSS compliance. If your business needs to meet PCI compliance, keep reading to find out what AoC means and why it’s essential to maintain compliance, avoid violations, and, most importantly, protect customers’ payment information.

What Is a PCI AoC?

Attestation of Compliance (AoC) is a declaration of an organization’s compliance with PCI DSS. A Qualified Security Assessor (QSA) completes this document, indicating a business’s PCI DSS AoC compliance status. A QSA is an individual employed by a QSA company (QSAC) and is certified by the PCI Security Standards Council as a PCI compliance assessor. Alternatively, a merchant can complete the AoC if their internal audit performs validation. Indeed, the AoC provides written evidence that a business has maintained security best practices designed to safeguard cardholder data. Additionally, this document offers written representation that an organization has completed the required annual Self-Assessment Questionnaire (SAQ) and has been verified by a QSA.

Every year, AoC documents are sent to an organization’s credit card acquirer to prove that they have upheld PCI DSS compliance. It’s important to note that the AoC requirements vary based on a merchant’s PCI level of compliance and specific card brand requirements.

Why Does It Matter?

An AoC is important because it proves that a business is PCI compliant and thus, is following best practices to maintain secure payment environments and protect cardholder data. If a merchant is not compliant, this jeopardizes their organization and their customers’ sensitive payment information. Indeed, failure to achieve compliance increases an organization’s risk of cyberattacks, which directly impact customers. Once a business gets hit by a breach, this can potentially harm thousands to millions of customers by exposing card payment details stored on an organization’s internal environment (e.g., ecommerce site, app, or form).

As for costs, non-compliant businesses can receive penalties ranging from $5,000 to $10,000 or more every month. There are also additional penalties and higher transaction fees associated with those that are not PCI compliant because they pose a greater risk for payment security risks. Furthermore, it’s also possible that a merchant’s bank will terminate their merchant account. This is a serious issue because a merchant account is necessary to accept, process, and transmit card payments. Without the ability to accept card payments, many customers may take their business elsewhere since debit and credit cards are the preferred payment method in today’s digital market.

Tokenization for PCI Compliance

From growing your business to creating new products or services, business leaders are tasked with many time-consuming tasks and objectives. If you handle credit and debit card payments, adding another ongoing task to your to-do list— maintaining PCI compliance—can be overwhelming. Luckily, there are security solutions in place designed to help secure cardholder data and stay out of scope. These solutions can include network segmentation and obfuscation techniques, such as encryption and tokenization. In particular, tokenization effectively reduces scope, lowers risk, and simplifies PCI compliance while also optimizing data business utility, agility, and flexibility.

Tokenization also boosts security because the payment data is inaccessible to cybercriminals. If a breach hits a business, the hackers will only find worthless tokens that don’t contain any of the corresponding original cardholder data. Further, storing cardholder data outside of a merchant’s environment will make it easier for a business to meet compliance requirements.