In 2020, credit cards accounted for 27% of all payments, according to a study by the Federal Reserve Bank of San Francisco, marking the highest percentage since the study began in 2016. Debit cards made up 28%, while cash use dropped to 19%, a seven-percentage-point decrease from 2019. Other payment methods, such as ACH payments, bank account transfers, online bill pay, and prepaid cards, represented 26%.
Accepting payment cards requires your business to comply with the Payment Card Industry Data Security Standard (PCI DSS) to safeguard customer information.
PCI DSS, or Payment Card Industry Data Security Standard, is a framework of security guidelines for businesses and service providers that store, process, transmit, or affect the security of cardholder data.
It is managed by the PCI Security Standards Council, an independent group created by major card brands such as Visa, MasterCard, American Express, Discover, and JCB. These brands also enforce compliance.
PCI DSS is not a law, but it is a contractual requirement between acquiring banks and payment card companies. Banks are responsible for ensuring compliance and may pass on fines to merchants who fail to meet the standards. In some states, like Nevada, Minnesota, and Washington, parts of PCI DSS have been incorporated into state law.
PCI DSS compliance involves working with your customers or acquiring banks to evaluate how your services affect cardholder data, identifying which requirements apply to your business, and implementing the necessary security measures.
The requirements cover both operational and technical safeguards, ensuring the secure storage, processing, and transmission of cardholder data, and protecting the networks and systems involved in these processes.
PCI DSS compliance means working with your customers or acquiring banks to determine how your service can impact cardholder data, determining exactly which PCI DSS requirements your organization is responsible for, and adhering to the applicable security controls listed within the PCI DSS framework.
These requirements cover a wide range of operational and technical controls that impact not only how cardholder data is stored, processed, or transmitted but also ensure the security of the machines and networks involved in these processes and the personnel responsible for administration of these controls.
Ensure firewalls and other network components are secure, allowing only essential traffic.
Configure networks and systems securely, removing default credentials before implementation.
Encrypt stored cardholder data and manage encryption keys responsibly.
Use strong encryption for data sent over the internet and other public networks.
Install and maintain antivirus software, ensuring it’s regularly updated and monitored
Implement secure coding practices and apply security patches in a timely manner
Limit access to systems and data to only those who require it for their role.
Use strong authentication measures, such as password complexity, session timeouts, and access reviews.
Ensure secure access to physical locations and media containing cardholder data.
Track all access to systems and data, ensuring security events are logged and responded to promptly.
Perform regular vulnerability scans and penetration tests to identify weaknesses.
Implement organizational policies for information security, risk management, and incident response.
Send us any question you have, we’ll annonymize it and post an answer in 72h or less on our “Ask us anything” page.
Embarking on the PCI compliance journey requires a structured approach. Here are five essential steps to guide your business to successful adherence.
Determine if PCI DSS applies to your business by assessing how you handle cardholder data and transactions.
Educate your team on the importance of PCI compliance and cybersecurity best practices to ensure secure cardholder data handling.
Implement necessary technical and operational safeguards, such as firewalls, encryption, and access controls, to meet PCI DSS standards.
Assign dedicated personnel, tools, and budget to manage PCI compliance, ensuring all requirements are met efficiently.
Regularly audit and test your systems to maintain compliance, addressing any vulnerabilities and staying updated with PCI requirements.
Meet with Matt and book a free 15-min call below to better understand how to implement PCI DSS compliance in your company
Curated by PCIcompliant.org, this page provides publicly-sourced information on everything related to the PCI DSS Directive. Presented in a clear and concise manner for easy consumption.
Disclaimer
The information provided on this website is intended for educational and informational purposes only. The content is not intended to be a substitute for professional advice or any other legal advisory, service, etc. The site’s administrators and contributors make no representations or warranties of the information on the site. Any reliance you place on such information is therefore strictly at your own risk.
Copyright By PCIcompliant.org
