The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements intended to ensure that all companies that process, store, or transmit credit card information maintain a secure environment against data theft and fraud.
While the PCI SSC (Payment Card Industry Security Standards Council) has no legal authority to compel compliance, it is a requirement for any business that processes credit or debit card transactions. PCI certification is also considered the best way to safeguard sensitive data and information, thereby helping businesses build long-lasting and trusting relationships with their customers.
PCI DSS Compliance Levels:
- Level 1: Applies to merchants processing more than six million real-world credit or debit card transactions annually. Conducted by an authorized PCI auditor, they must undergo an internal audit once a year. In addition, once a quarter they must submit a PCI scan by an Approved Scanning Vendor (ASV).
- Level 2: Applies to merchants processing between one and six million real-world credit or debit card transactions annually. They’re required to complete an assessment once a year using a Self-Assessment Questionnaire (SAQ) and a quarterly PCI scan may be required.
- Level 3: Applies to merchants processing between 20,000 and one million e-commerce transactions annually. They must complete a yearly assessment using the relevant SAQ and a quarterly PCI scan may be required.
- Level 4: Applies to merchants processing fewer than 20,000 e-commerce transactions annually, or those that process up to one million real-world transactions. A yearly assessment using the relevant SAQ must be completed and a quarterly PCI scan may be required.
THE 12 REQUIREMENTS FOR PCI DSS COMPLIANCE
1. USE AND MAINTAIN FIREWALLS
2. PROPER PASSWORD PROTECTIONS
3. PROTECT CARDHOLDER DATA
4. ENCRYPT TRANSMITTED DATA
5. USE AND MAINTAIN ANTI-VIRUS
6. PROPERLY UPDATED SOFTWARE
7. RESTRICT DATA ACCESS
8. UNIQUE IDS FOR ACCESS
9. RESTRICT PHYSICAL ACCESS
10. CREATE AND MAINTAIN ACCESS LOGS
11. SCAN AND TEST FOR VULNERABILITIES
12. DOCUMENT POLICIES