What is PCI DSS?
PCI DSS stands for Payment Card Industry Data Security Standard. Credit card companies mandate credit card compliance via PCI DSS to help ensure the security of credit card transactions in the payments industry.
Who Must Follow PCI DSS?
Companies that must achieve card compliance through PCI DSS include any company that accepts, processes, stores, or transmits payment card information (i.e., credit or debit card information), such as merchants, point-of-sale vendors, financial institutions (e.g., banks, creditors), and developers who create the programs used to process payments.
The 12 requirements of Card Compliance Outlined By PCI DSS
- A firewall configuration must be installed and maintained a to protect cardholder data.
- Vendor-supplied defaults for system passwords and other security parameters should not be used.
- Cardholder data should be protected.
- Transmission of cardholder data across open, public networks should be encrypted.
- Anti-virus software or programs should be used and regularly updated.
- Secure systems and applications should be developed and maintained.
- Access to cardholder data should be restricted for only “need-to-know” purposes.
- Unique ID should be assigned to each person with computer access.
- Physical access to cardholder data should be restricted.
- Access to network resources and cardholder data should be tracked and monitored.
- Security systems and processes should be regularly tested.
- A policy that addresses information security for all personnel should be maintained.
How To Get Started With PCI DSS
Before you start digging into the requirements for PCI DSS, you’ll want to define your PCI DSS scope. This will help you reduce the compliance costs, operation costs, and risk associated with interacting with payment card data. This involves a few exercises:
- Identify how and where the company receives cardholder data
- Find and record where account data is stored, processed, & transmitted
- Identify all other system components, processes, and personnel that are in scope.
- Implement controls to minimize scope to necessary components, processes, and personnel
Let Red Lion Assist in your Card Compliance Efforts
Do you still have questions regarding PCI DSS? Our compliance professionals can help you to understand and achieve card compliance, regardless of complexity.
Contact Us Today