PCI DSS: Are you taking payment security seriously?
What is the PCI DSS?
If you are a business that takes credit or debit card payments, no matter how big or small you are, you will need to comply with the Payment Card Industry Data Security Standard (PCI DSS). The regulations are there to protect your business as well as your customers.
The PCI DSS was developed to encourage and enhance cardholder data security, and to facilitate the broad adoption of consistent data security measures globally. As a general guideline, any merchant or service provider that stores, processes or transmits cardholder data is required to comply with the Standard. Organisations that fail to comply are likely to get less beneficial commercial terms (and may even be refused service), and those that suffer a breach and are found to have fallen out of compliance are likely to face significant fines.
For advice and guidance on the PCI DSS or to find out more about our cost-effective solutions, get in touch with one of our experts today.
Speak to an expert
Why is compliance important?
With the General Data Protection Regulation (GDPR) affecting any company that does business in the EU, the penalties for taking inadequate security precautions around payment card data are about to get worse.
Although PCI DSS compliance is improving, research shows that even among the companies that pass validation, nearly half fall out of compliance within a year. This could be because of one or more of the following:
- A change to the PCI DSS (the latest version is 3.2), or the interpretation of the PCI DSS
- New software/technology that was not implemented with PCI DSS controls in mind
- A process or policy that is in need of modification
- Organisation, personnel or vendor changes
- A system that was not tested during the previous assessment
If implemented correctly, the PCI DSS can help organisations secure cardholder data. It provides a baseline set of security requirements, which lets organisations know what action they should take. One of the key benefits of the PCI DSS is that it provides a detailed action plan that can be applied to companies of any size or type that use any method of processing or storing payment card data.
Penalties for non-compliance with the PCI DSS
The breach or theft of cardholder data affects consumer confidence that results in the loss of business. Any merchant that breaches the PCI DSS could face serious consequences, including fines, litigation and reputational damage. The implications can be far-reaching and include:
- Fraud losses
- Loss of customer confidence
- Diminished sales
- Cost of reissuing new payment cards
- Higher subsequent costs of compliance
- Legal costs, settlements and judgments
- Fines and penalties
- Termination of ability to accept payment cards
- Lost jobs
Payment data – a target for attack
Payment card data is the prime target in attacks against commercial environments.
Indeed, the 2018 Trustwave Global Security Report identified that threat actors targeted payment card data in most incidents, with card-track (magnetic stripe) data making up nearly 23% of events, and CNP (card-not-present) data, which is mostly used in e-commerce transactions, comprising almost 20%.
Criminal hackers want your cardholder data. By obtaining the PAN (primary account number) and sensitive authentication data, an attacker can impersonate the cardholder, use the card, and steal the cardholder’s identity. Following guidance in the PCI DSS helps keep your cyber defences primed against attacks aimed at stealing cardholder data.
The PCI DSS
Payment security is important for every merchant, financial institution or other organisation that stores, processes or transmits cardholder data.
The PCI DSS specifies 12 requirements that are organised into six control objectives.
Goals
Build and Maintain a Secure Network
PCI DSS requirements
- Install and maintain a firewall configuration to protect cardholder data
- Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data
- Protect stored cardholder data
- Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program
- Use and regularly update anti-virus software or programs
- Develop and maintain secure systems and applications
Implement Strong Access Control Measures
- Restrict access to cardholder data by business need-to-know
- Assign a unique ID to each person with computer access
- Restrict physical access to cardholder data
Regularly Monitor and Test Networks
- Track and monitor all access to network resources and cardholder data
- Regularly test security systems and processes
Maintain an Information Security Policy
- Maintain a policy that addresses information security for employees and contractors
The exact PCI DSS compliance requirements vary depending on the annual number of card transactions processed by your organisation.
For organisations that process more than six million card transactions annually
Large organisations must have an external audit performed by a QSA (Qualified Security Assessor) and submit a RoC (Report on Compliance) to their acquiring banks to prove their compliance each year. Your assessor will:
- Validate the scope of the assessment;
- Review all documentation and technical information provided;
- Determine whether the Standard has been met;
- Provide support and guidance during the compliance process;
- Be onsite for the duration of the assessment as required;
- Adhere to the PCI DSS assessment procedures;
- Evaluate compensating controls; and
- Produce the final RoC.
For organisations that process fewer than six million card transactions annually
Most small merchants can use a self-validation tool to assess their level of cardholder data security.
The SAQ (self-assessment questionnaire) includes a series of yes-or-no questions for each of the applicable PCI DSS requirements. There are nine different questionnaires available to meet different merchant environments.
Regardless of how many transactions you process, you will also be required to run internal and external network vulnerability scans at least quarterly and after any significant change in the network.
Discover our range of PCI DSS products and services
IT Governance provides services to support you at each stage of your organisation’s PCI DSS compliance project. Whether you need to conduct a gap analysis, reduce the scope of your cardholder data environment, conduct a risk assessment or test the security of your systems and processes for vulnerabilities, we can help. View our range of products and services to find out more about what we can do.
PCI DSS products and services
Speak to an expert
For more information about the PCI DSS and what your organisation needs for compliance, please get in touch with one of our experts, who will be able to advise you further.