PCI DSS Compliance

Why is PCI DSS compliance important?

If you are a business that manages online payments and credit card information, you understand the importance of complying with the Payment Card Industry Data Security Standard (PCI DSS). The PCI is a global security standard that regulates how companies process, store, and transmit cardholder information and/or sensitive authentication data. Five major international brands established it in order to improve account and transaction security.

Here is a quick summary of the PCI DSS requirements for protecting payment card information:

1. Build and Maintain a Secure Network and Systems

• Install and maintain a firewall to protect cardholder information
• Do not use vendor-supplied system passwords and other security parameters

2. Protect Cardholder Data

• Encrypt transmission of cardholder data across open, public networks
• Protect stored cardholder data

3. Maintain a Vulnerability Management Program

• Regularly update anti-virus software or programs to protect against malware
• Develop and maintain secure systems and applications

4. Implement strong access control measures

• Restrict access to cardholder data on a need-to-know basis
• Identify and authenticate access to system components
• Restrict physical access to cardholder data

5. Regularly monitor and test networks

• Regularly test security systems and process
• Track and monitor all access to network resources and cardholder data

6. Maintain an information security policy

• Maintain a policy that addresses information security for all employees

What are the penalties for PCI DSS violations?

The PCI has established strict guidelines regarding the processing, transmission, and storing of payment card information.

Failure to comply with PCI DSS can result in fines of up to $500,000 USD per incident, or $5,000 to $100,000 (depending on the business size) until merchants achieve compliance.

In addition, businesses can experience increased transaction fees with their payment service providers for non-compliance.