What does PCI DSS stand for and how it affects your business?
PCI DSS (Payment Card Industry Data Security Standard) is a global organization that involves the promotion of credit cardholder data standards in businesses around the world.
The main objectives are to enhance, propagate, and assist with developing an awareness of standards for secure payment involvers.
It was determined by principal credit card institutions:
- JCB.
- Discover Financial Services.
- American Express.
- MasterCard Worldwide.
- Visa.
- MasterCard.
What were the prerequisites for creating the PCI council?
There are many criminals, and the online payment industry is not an exception. For starters, credit card companies had faced lots of data breaches that led to the loss of a significant quantity of credit card data. And they got sick of it and decided to hit the fraud before it hit them.
According to Privacy Rights organization, about 11 billion substantial informational records have been breached.
On the other hand, payment institutions started implementing their security standards. Such a tendency has brought to implementation a unite PCI DSS standard.
What is PCI DSS empowered to?
- The organization offers rules for security policies, various processes that are aimed to protect payment systems and drop out theft of cardholders data. Besides, not only payment providers but all the parties that touch cardholders’ data are under these rules.
- Manages accreditations for certified auditors.
- Monitor and collect information to maintain and spread knowledge.
PCI DSS offers materials, including frameworks of specifications, tools, support resources to support organizations to ensure the cardholders’ data are secured safety.
The requirements of the standard
The PCI DSS security obligations for the components of the infrastructure in which payment card information is transmitted, processed or stored. Checking the payment infrastructure for compliance. It reveals mistakes that significantly reduce its level of security. Penetration tests, which are included in the list of mandatory activities regulated by the PCI DSS standard, show the real level of security of the company’s information resources both from the position of an attacker located outside the monitored district and from the position of a company employee who has access from the inside.
The PCI DSS Council has conceived key data protection standards in the PCI DSS document.
The group of these requirements you can find below.
- Creating and implementing a trusted network
Requirement 1: Install and keep operating firewalls to ensure a data protection.
Requirement 2: avoid the usage of default security passwords provided by manufactures.
- The protection of cardholder’s data
Requirement 3: Companies must protect cardholder data during storage.
Requirement 4: provide data encryption when cardholder data transmitting is taken place.
- Security vulnerability Management Program oversight
Requirement 5: Adapt and regularly update the antivirus.
Requirement 6: Design and support secure systems and applications.
- Embed strict access control measures
Requirement 7: Restrict access to cardholder data by business need to know.
Requirement 8: For each infrastructure’s member who touch secure information implement a unique identifier.
Requirement 9: Limit physical access to cardholder data.
- Implement internal network regular monitoring
Requirement 10: Monitor and track all access sessions to resources of network and cardholder’s data.
Requirement 11: Regular monitoring and security systems and processes testing.
- Security Policy Support
Requirement 12: implementation, development and spreading the awareness of information security policies.
Certification
Organizations can obtain PCI DSS certification in three ways:
- External Audit (QSA)
- Internal Audit (ISA)
- Self Assessment (SAQ).
1) PCI SSC Council empowers an independent auditor who performs an audit. This manager collects all compliance proofs.
All the results will be stored for a certain period, based on the type of the security level of an organization.
2) ISA Internal Audit is performed by an internal specialist who has been trained and certified under the PCI SSC Council program.
3) To be aware of the level of the company’s data security, the PCI council implemented a Self Assessment Questionnaire. With this information, companies can obtain a better understanding of security strategy implementation to be PCI compliant.
Expenses to be a PCI DSS compliant business
There is a four-level scale of data security by PCI DSS, and the cost for each of the stages varies.
Level 4: For these businesses Approved Scanning Vendor providing via the Internet. Upon completion of the scan, the orderer receives a report containing a list of vulnerabilities found by the scanner in its infrastructure.
Vulnerability elimination is provided by the company independently. After the removal of all defects, rescanning is performed to ensure that the vulnerabilities are resolved.
The cost for such a procedure is about 80$/year.
Level 3: For annual passthrough, the Self Assessment Questionnaire and Attestation of Compliance price starting at $1,200 a year and depends on the size of your network and number of IP addresses.
For Level 2 businesses, for merchants who provide 1 – 6 million transactions per year, the costs may vary from $10,000 to $50,000 for one year.
For institutions at Level 1 of compliance, costs can range from $50,000 and higher.
The bottom line
What will the company receive as a result of an audit of compliance with the PCI DSS standard?
- Your company becomes compliant with the requirements of international payment systems.
- The risks from the possible flows of confidential information are reducing.
- Customer loyalty and trust are rising.
By simply words, we can conclude that compliance with the PCI DSS standard is critical in the modern business world.
It is imperative to be aware of the following: if your organization stores, processes, or transfers information about at least one card transaction or payment cardholder during the year, then you, as a company, must comply with the PCI DSS standard.
