PCI DSS

PCI DSS stands for Payment Card Industry Data Security Standard. It’s a set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information maintain a secure environment.

The PCI standard is only applicable to organisations that process, transmit or store cardholder data. These organisations include merchants, such as retailers and e-commerce stores, payment service providers, financial institutions, and healthcare providers.

Completing a Self-Assessment Questionnaire (SAQ) will help determine if you’re PCI DSS compliant. This assessment is targeted at smaller merchants with less than a million transactions per year.

If your transaction volumes are larger, you will need a Qualified Security Assessor, like us, to audit your cardholder data handling practices. Through a PCI Gap Analysis or assessment, we’ll verify your compliance with PCI standards and identify areas for improvement to enhance your security measures.

A PCI DSS assessment is performed annually. The type of assessment depends on your compliance level. You must maintain compliance as an ongoing commitment to ensure cardholder data remains secure all year round.

A PCI DSS scope assessment will uncover ways to reduce scopes across your organisation’s cardholder data environment. As part of this service, our QSAs will advise you on how best to reduce your scope so you can simplify your compliance and save money.

PCI compliance shows that your business is committed to protecting cardholder data, which helps build trust with your customers. Better security controls will minimise the risk of theft or data breaches, which can cause considerable financial damage in terms of penalties, fines and legal costs.

The levels of PCI DSS compliance for merchants are as follows:

• Level 1: Merchants processing over 6 million card transactions annually.
• Level 2: Merchants processing 1 to 6 million transactions annually.
• Level 3: Merchants processing 20,000 to 1 million transactions annually.
• Level 4: Merchants that process less than 20,000 transactions annually.

The PCI standard has 12 requirements, which are organised into six control objectives.

These include:

1. Install and maintain a firewall configuration to protect cardholder data
2. Do not use vendor-supplied defaults for system passwords and other security parameters
3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across open, public networks
5. Use and regularly update anti-virus software or programs
6. Develop and maintain secure systems and applications
7. Restrict access to cardholder data by business need to know
8. Assign a unique ID to each person with computer access
9. Restrict physical access to cardholder data
10. Track and monitor all access to network resources and cardholder data
11. Regularly test security systems and processes
12. Maintain a policy that addresses information security for all personnel

A PCI assessment analyses an organisation’s compliance with the data security standards set by the PCI Security Standards Council.

A Qualified Security Assessor will conduct the assessment for Level 1 and 2 merchant organisations. Level 3 and 4 merchant organisations (those processing transactions less than a million) will need to complete a Self-Assessment Questionnaire.

You need to continuously monitor and maintain your security practices to remain compliant with the PCI DSS. Aside from an annual assessment, you’ll need to validate your compliance efforts through regular improvements.