All About PCI Compliance

The Payment Card Industry Data Security Standard (PCI DSS) is a widely accepted set of policies and procedures intended to optimize the security of credit, debit and cash card transactions and protect cardholders against misuse of their personal information. The PCI DSS was created jointly in 2004 by four major credit-card companies: Visa, MasterCard, Discover and American Express.

Credit card issuers are aggressively enforcing the PCI DSS to safeguard cardholder information and prevent losses; non-compliance with the standard can result in significant fines or losing their ability to process credit cards. In addition companies are required to validate their PCI DSS compliance annually.

The core principles of the PCI DSS framework consist of twelve requirements categorized into six Control Objectives or Functional Areas. Organizations must comply with all the requirements to meet the overall objective of PCI DSS.

Organizations that are required to be compliant under the scheme must adhere to 12 PCI compliance requirements within 6 control objectives. 

These are:

1. Build and Maintain a Secure Network

Requirement 1: Install and maintain a firewall configuration to protect cardholder data.
Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters.

2. Protect Cardholder Data

Requirement 3: Protect stored cardholder data.
Requirement 4: Encrypt transmission of cardholder data across open, public networks.

3. Maintain a Vulnerability Management Program

Requirement 5: Use and regularly update anti-virus software.
Requirement 6: Develop and maintain secure systems and applications.

4. Implement Strong Access Control Measures

Requirement 7: Restrict access to cardholder data by business need-to-know.
Requirement 8: Assign a unique ID to each person with computer access.
Requirement 9: Restrict physical access to cardholder data.

5. Regularly Monitor and Test Networks

Requirement 10: Track and monitor all access to network resources and cardholder data.
Requirement 11: Regularly test security systems and processes.

6. Maintain an Information Security Policy

Requirement 12: Maintain a policy that addresses information security.

It is a strict standard that applies to the cloud as well as in-store, providing security no matter where the information is held. In June of 2011 the PCI Security Standard Council stated that “any device that stores or transmits cardholder data is overseen by PCI DSS”. This includes all hardware and software programs in the cloud.

If your business or organization processes debit card or credit card information, and is considering moving to the cloud, make sure that you select a PCI compliant cloud company. This will keep your information and those of your customers in a secure environment.

Source: CodeWebber