The Payment Card Industry Data Security Standard refers to a set of guidelines and standards for businesses to ensure the security of their credit card transactions. Created by Visa, Mastercard, Discover, and American Express in 2004, this standard applies to companies of any size that accept credit card payments, and has evolved over the years to ensure that online sellers have the systems and processes in place to prevent data breaches.
Business owners know that ecommerce transactions have been significantly on the rise over the past few years, and there are no signs of that slowing down. What accompanies this trend is a rising concern about the security of customer data when it comes to online payment transactions. If you collect, transmit, process or store any credit card transactions, you are ultimately liable for any information you collect, and therefore are subject to consequences should that information be compromised. That’s where PCI compliance comes in.
If you collect, transmit, process or store any credit card transactions, you are ultimately liable for any information you collect, and therefore are subject to consequences should that information be compromised.
PCI compliance can be overwhelming to the average business owner because the reality is that you must educate yourself on a variety of security protocols and processes. Fortunately, with a bit of help, you can successfully navigate these waters and achieve compliance in no time.
Companies can use various tools to achieve PCI compliance. However, having a well-structured compliance implementation checklist is critical and makes the process much easier. There are 12 mandates that every merchant should be familiar with:
FIREWALL
Protect cardholder data with a firewall. Every device interacting with cardholder data must have a firewall installed, warding your network against outside attacks. This will ensure all transactions happen safely.
PASSWORDS
Immediately change passwords as soon as you receive them from the vendors. Have different passwords than those provided. Make it unique, use password management software to generate a random password, or use three random words for each.
DATA PROTECTION
Protect stored cardholder information, both physical and digital. Writing down physical data requires a strict process to prevent it from being in a situation where it is not protected, while digital data must be protected using encryption and firewalls.
ENCRYPTION
PCI-compliant encryption is essential to preventing data and information from being stolen during the transfer between the issuing bank and acquiring bank. Encrypt cardholder data that passes through open, public networks and confirm this at the point of sale (POS).
ANTIVIRUS SOFTWARE
Install and update antivirus software. If you’re not frequently updating to the latest versions, potential vulnerabilities will not be patched. Regularly use the virus scan option and set up a repeatable checklist process that you carry out monthly to scan and download whatever is needed.
SECURE SYSTEMS
Implement a security checklist to ensure secure systems and applications. This process can be implemented to address any vulnerabilities and keep all your software up to date, such as firewalls, antivirus software, apps and POS.
CARDHOLDER DATA
Keep employees’ access to cardholder data minimal to reduce the chance of a breach. Only those with a legitimate “need to know” should access cardholder data.
ID PERMISSIONS
Grant ID permissions to users with access to cardholder details. Assign unique IDs to each employee who needs access, enabling a way to track precisely who logs in and when.
PHYSICAL ACCESS
Physical access to cardholder information should be restricted and monitored. Remember to log out when leaving a terminal and add a timeout after a short period of inactivity is detected.
PERMISSIONS
Track permissions to cardholder data and network resources. Track who is logged in at what times and consider surveillance for fraudulent activity.
SECURITY PROCESSES
Test security processes and systems frequently. Create a security process checklist that employees must follow to protect data, regularly test that this process is still working and improve where needed.
SECURITY POLICY
Develop an information security policy to determine the guidelines and a method for proving and tracking compliance. Policies and procedures should identify how standards are maintained for auditors to verify your compliance.
To make these mandates easier to implement, businesses can follow these tips for meeting compliance requirements:
- Buy and use only approved PIN entry devices at your POS.
- Buy and use only validated payment software at your POS or website shopping cart.
- Do not store any sensitive cardholder data.
- Use a firewall on your network and PCs.
- Make sure your wireless router is password-protected and uses encryption.
- Use strong passwords. Be sure to change default passwords on hardware and software; most are unsafe.
- Regularly check PIN entry devices and PCs to ensure no one has installed rogue software or “skimming” devices.
- Teach your employees about security and protecting cardholder data.
- Follow the PCI Data Security Standard.
- Ensure peer-to-peer encryption.
Whatever the size of your business, PCI compliance is a must. It can save you the cost of a data breach and build customer confidence and loyalty. To learn more about PCI compliance, contact a trusted payment processor for assistance.
Jonathan Corona has over 15 years of experience in the electronic payments industry. As MobiusPay’s COO, Corona is primarily responsible for day-to-day operations as well as reviewing and advising merchants on a multitude of compliance standards set forth by the card associations. MobiusPay specializes in merchant accounts in the U.S., EU and Asia. Follow them @MobiusPay on Twitter, Facebook and IG.
