PCI DSS Compliance

The official PCI Security Standards Council Site details information about PCI Compliance, Assessors and Solutions, Training and Qualification. The PCI Security Standards Council (PCI SSC) is a global forum that brings together payments industry stakeholders to develop and drive adoption of data security standards and resources for safe payments worldwide.

PCI DSS is mandatory worldwide. It applies to any organisation, without regard to size, value, or number of transactions, if that organisation collects, transmits, maintains, or transfers card data. Anyone who transacts with one of the major credit card companies such as Visa, Mastercard, American Express or Discover, must comply with the data security standard. In other words, if credit card information touches your secure network at any point, you must comply with these PCI standards.

The PCI DSS regulation applies to card payments over all channels, including in store and online.

Even if your contact centre does not record telephone calls, it does not make you compliant – you will only have met a single requirement out of hundreds. Manual ‘pause and resume’ on calls is also not compliant. Download Encoded’s booklet – The Truth about PCI DSS in Contact Centres for more information.

Becoming compliant means taking measures regularly. No one size fits all – every organisation is set up differently and therefore needs to be assessed on an individual basis and depending on the kinds of security risks that the business faces.

There are four PCI compliance levels, which are determined by the number of transactions an organisation handles each year.

• Level 1: Merchants that process over 6 million card transactions annually.
• Level 2: Merchants that process 1 to 6 million transactions annually.
• Level 3: Merchants that process 20,000 to 1 million transactions annually.
• Level 4: Merchants that process fewer than 20,000 transactions annually.

To become compliant there is a PCI checklist of 12 requirements, consisting of 258 controls, which must be implemented and the cost of this to a business can vary significantly. To many, the costs involved can be prohibitive but there is money to be saved by undertaking a programme of reducing the scope of the cardholder data environment (or de-scoping). The 12 high level requirements fall into the six categories below:

Build and Maintain a Secure Network
1. Install and maintain a firewall configuration to protect cardholder data
2. Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data
3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program
5. Use and regularly update anti-virus software or programs
6. Develop and maintain secure systems and applications
Implement Strong Access Control Measures
7. Restrict access to cardholder data by business need-to-know
8. Assign a unique ID to each person with computer access
9. Restrict physical access to cardholder data
Regularly Monitor and Test Networks
10. Track and monitor all access to network resources and cardholder data
11. Regularly test security systems and processes
Maintain an Information Security Policy
12. Maintain a policy that addresses information security for employees and contractors.

The type of audit you must undergo, and your exact PCI DSS requirements will vary depending on your merchant or service provider level.

To truly understand the best practices for each of the 258 boxes that should be ticked takes a real specialist; however, looking at the key vulnerabilities, namely staff and the choice of third-party payments supplier, will result in large reductions in both PCI DSS scope.

The SCC publishes the latest details and documents on PCI DSS compliance on its website, including reference guides, policy templates and forms and FAQs.

Merchants and service providers can demonstrate their compliance with the PCI DSS by completing an audit of their CDE (cardholder data environment) against the applicable requirements of the Standard. The types of audit are:

• An RoC (Report on Compliance) completed by a PCI QSA (Qualified Security Assessor) organisation such as IT Governance or by an ISA (Internal Security Assessor).
• An Self-assessment Questionnaire (SAQ) signed by an officer of the organisation. There are nine types of SAQ designed to meet different types of merchant and service provider’s requirements.
• An external vulnerability scan conducted by an ASV (Approved Scanning Vendor).

The type of audit you must undergo, and your exact PCI DSS compliance requirements will vary depending on your merchant or service provider level, based on the number of card transactions processed per year.

Scoping is an annual process and must occur prior to the annual assessment. Merchants and other entities must identify all locations and flows of cardholder data to ensure all applicable system components are included in scope for the PCI Data Security Standard.

The amount of time and work required demonstrating compliance can be dramatically reduced when working with a third-party payment solution provider. However, the responsibility for PCI compliance cannot be entirely removed. PCI DSS covers the entire trading environment, which means all third-party partners and vendors that handle card data on their behalf or supply services where card data is transmitted, must also comply before full PCI DSS compliance is achieved.

When a merchant uses a validated third party to capture the payment information from their own website, the actual process of data capture bypasses their systems. In this way, they need not hold client data in-house and thus alleviate some of the risk and obligations associated with PCI compliance.

One of the latest versions of PCI DSS introduced a new requirement for service providers to supply a “Responsibility Matrix” which defines who is responsible for each of the 300+ PCI controls; namely the client, the supplier or both.

Every organisation is set up differently and therefore needs to be assessed on an individual basis. What you’ll need to do to become compliant is dependent on the kinds of security risks that your business faces.

Many small- and medium-sized businesses can prove their compliance with PCI DSS by filling out a Self-Assessment Questionnaire (SAQ). You can also choose to have your payment environment assessed by an accredited Qualified Security Assessor, but this usually applies to larger organisations due to the costs and volume of transactions involved.

Known by the acronym SAQ, a Self-Assessment Questionnaire is a form that organisations must complete to confirm compliance with each requirement of the PCI DSS necessary.

A Self-assessment Questionnaire (SAQ) is signed by an officer of the organisation. There are nine types of SAQ designed to meet different types of merchant and service provider’s requirements.

Some third-party payment solution providers (such as Encoded) have a tokenisation feature to enable card holders to validate and amend stored cards when something goes wrong; avoiding fines, fees and interest charges by self-managing the details held on file.