PCI DSS Requirements

General

The PCI Data Security Standards help protect the safety of cardholder data. They establish operational and technical requirements for organizations that accept or process payment transactions, in addition to software developers and manufacturers of payment applications and devices.

It is a set of standards and guidelines for businesses to manage and secure personal data associated with credit cards. In 2006, the three major credit card companies – Visa, Mastercard, and American Express – established Payment Card Industry Data Security Standards (PCI DSS) guidelines to safeguard credit card data against theft.

According to experts, credit card fraud costs businesses in the United States billions of dollars each year. It should be self-evident that cybercriminals are winning the war on credit cards currently.

Consumers, businesses, and banks must prioritize the protection of customer data and payment information to avoid wasting billions of dollars on credit card fraud. Recognizing and enhancing your PCI compliance capability is critical to winning the war.

Who is required to comply with the PCI DSS?

PCI DSS applies to all entities involved in payment card processing including merchants, processors, acquirers, issuers, and service providers, according to the official PCI Security Standards Council website.

Similarly, the PCI DSS applies to any entity that stores, processes, or transmits cardholder data (CHD) and/or sensitive authentication data (SAD).

Determining an organization’s assessment requirements can be very confusing. There are multiple levels of PCI reporting for merchants, depending on the volume of credit card transactions processed each year. Additionally, to add to the confusion, each credit card brand has its own reporting structure.

How Do You Become a PCI Compliant Organization?

PCI DSS is the road map for achieving PCI compliance. PCI DSS is a 12-step process for safeguarding customer data. The 12 PCI requirements are listed below:

Build and Maintain a Secure Network and Systems

• Requirement 1: Install and maintain a firewall configuration to protect cardholder data
• Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data

• Requirement 3: Protect stored cardholder data
• Requirement 4: Encrypt transmission of cardholder data across open, public networks

Maintain a Vulnerability Management Program

• Requirement 5: Protect all systems against malware and regularly update anti-virus software or programs
• Requirement 6: Develop and maintain secure systems and applications

Implement Strong Access Control Measures

• Requirement 7: Restrict access to cardholder data by business need to know
• Requirement 8: Identify and authenticate access to system components
• Requirement 9: Restrict physical access to cardholder data

Regularly Monitor and Test Networks

• Requirement 10: Track and monitor all access to network resources and cardholder data
• Requirement 11: Regularly test security systems and processes

Maintain an Information Security Policy

• Requirement 12: Maintain a policy that addresses information security for all personnel

How do I ensure my PCI Compliance is valid?

Each credit card company is required to adhere to its own compliance validation standards. You can either conduct your own PCI Compliance Self-Assessment Questionnaire (SAQ) or hire a PCI Quality Security Assessor (QSA).

Qualified Security Assessors PCI Compliance (QSA)
PCI QSAs have received certification and training to conduct PCI security assessments. Different QSAs will have a greater familiarity with certain types of businesses, so if you choose this route, be sure to find one that understands your business’s requirements.

Self-Assessment Questionnaire PCI Compliance (SAQ)
The other option is to complete the SAQ, which is a series of yes/no questions used to determine your level of PCI DSS compliance. Each organization conducts the SAQ and submits quarterly reports to the organizations to which they are required to report.

What steps do I need to take to comply with PCI?

PCI compliance is a continuous process that entails adhering to the 12 requirements of the PCI DSS. In general, achieving PCI DSS compliance requires the following 4 steps:

• Thoroughly review the PCI DSS compliance requirements. There are 6 overarching objectives, 12 requirements, and approximately 251 sub-requirements to review.
• Determine the compliance requirements applicable to your organization. Depending on your business category, as defined by the PCI Council in terms of annual transaction volume, your organization will be subject to a unique set of requirements.
• Conduct a review of your current processes and develop a plan to implement the requirements necessary to achieve PCI compliance.
• Complete a Self-Assessment Questionnaire (SAQ) or enlist the assistance of a qualified security assessor (QSA) for your final PCI compliance assessment.

Clone Systems has been an Approved Scanning Vendor (ASV) for over 15 years and has exceeded the traditional MSSP model to ensure compliance with Payment Card Industry Data Security Standards (PCI DSS).

Read more about how Clone Systems assists you on your compliance journey by visiting the Clone Guard PCI Compliance Scanning.