By October 1st, all merchants will need to ensure they are PCI Compliant. Businesses and organisations that take online payment through credit or debit card should be familiar with PCI Compliance, an abbreviated acronym for Payment Card Industry Data Security Standards (PCI DSS).
PCI Compliance refers to a rigorous set of criteria that must be met to ensure that customer payment information is secure. While not strictly law, compliance is enforced by Payment Service Providers, and failure to meet this criteria can result in a substantial fine, or even the disabling of your business’ ability to perform transactions. You can take the PCI Security Standards Council’s online self assessment questionaire to see whether you meet their criteria.
There are twelve PCI data security standard requirements. These security requirements apply to all system components. A ‘system component’ can be defined as any network component, server, or application that is included in or connected to the cardholder data environment:
Build and Maintain a Secure Network
- Requirement 1: Install and maintain a firewall configuration to protect cardholder data
- Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data
- Requirement 3: Protect stored cardholder data
- Requirement 4: Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program
- Requirement 5: Use and regularly update anti-virus software
- Requirement 6: Develop and maintain secure systems and applications
Implement Strong Access Control Measures
- Requirement 7: Restrict access to cardholder data by business need-to-know
- Requirement 8: Assign a unique ID to each person with computer access
- Requirement 9: Restrict physical access to cardholder data
Regularly Monitor and Test Networks
- Requirement 10: Track and monitor all access to network resources and cardholder data
- Requirement 11: Regularly test security systems and processes
Maintain an Information Security Policy
- Requirement 12: Maintain a policy that addresses information security
Legislation is always evolving in this area, especially with advancing technologies and the rise in online fraud and it’s important to check regularly with changes in requirements.