Protecting customer data is critical, especially for businesses that accept credit cards. These businesses face pressure to implement strong security measures. Enter PCI DSS, the Payment Card Industry Data Security Standard. This regulation provides a comprehensive framework to safeguard cardholder data and prevent fraud.
Credit card transactions account for 81% of in-store transactions in the U.S. In 2023, according to the Nilson Report, major credit card issuers processed a whopping $4.6 trillion in retail business. That’s over $12.7 billion in purchase volume per day.
Thieves and scam artists go where the action is, making credit card transactions—both in person and over the internet—ripe targets for theft and fraud. According to the Federal Trade Commission, credit card fraud cost businesses and consumers more than $10 billion in 2023.
This post highlights the standards and requirements and what merchants need to follow to protect their clients from credit card fraud. Follow the links for a deeper dive into full compliance with each of the standards outlined below.
Fighting Payment Card Breaches With PCI DSS
Complying with PCI DSS is how businesses can mitigate and thwart credit card breaches, therefore lowering the amount of credit card fraud. The standard consists of security practices and technology requirements to prevent credit card customer data theft. PCI DSS compliance demonstrates that the merchant has undergone a rigorous security certification process and adheres to each of the 12 security standards detailed in the PCI DSS Quick Reference Guide.
The 12 Standards for PCI DSS Compliance
The following is a summary of those security standards and examples of how a merchant could maintain compliance.
Requirements to Build and Maintain Secure Network and Systems
1. Install and maintain network security controls.
- Compliance Example 1: The company installs and configures a firewall. The firewall restricts incoming and outgoing traffic that is required for core business operations. This includes safeguards for every device in the company’s network.
2. Apply secure configurations to all system components.
- Compliance Example 2: Vendor-supplied default passwords and configurations are well-known and easy to breach. The company changes and updates the passwords and configuration settings that come as equipment defaults.
Requirements to Protect Cardholder Data
3. Protect stored account data.
- Compliance Example 3: The company only stores cardholder data when necessary and only for as long as needed. This includes displaying the cardholders’ account numbers to show only the final four or six digits in the accounts.
4. Protect cardholder data with strong cryptography during transmission over open public networks.
- Compliance Example 4: The company encodes cardholder data with industry-standard cryptology when the data is transmitted over the Internet. This is especially important when cardholder data is transmitted over unprotected public networks where hackers lurk to intercept customer transactions.
Requirements to Maintain a Vulnerability Management Program
5. Protect all systems and networks from malicious software.
- Compliance Example 5: The company deploys state-of-the-art antivirus software and ensures that all security policies are documented and known to users. Moreover, antivirus software is deployed on all personal computers and servers with periodic scans using audit logs.
6. Develop and maintain secure systems and software applications.
- Compliance Example 6: The company promptly installs the most recently released software patches and follows secure coding practices for software applications. This includes applications being developed or deployed by the company.
Requirements to Implement Strong Access Control Measures
7. Restrict access to system components and cardholder data according to the user’s need to know.
- Compliance Example 7: The company grants physical access to cardholder information only to those who need to know as required by job responsibilities. This includes access to the absolute minimum level of privileges required to do the job.
8. Identify users and authenticate access to system components.
- Compliance Example 8: The company defines and enforces policies for user identification. This includes a unique ID for each person with access to cardholder information, thus allowing the tracking/detection of attempted unauthorized access.
9. Restrict physical access to cardholder data.
- Compliance Example 9: The company prohibits unauthorized access and enforces restrictions on physical access to data/systems that contain cardholder data. This includes a host of physical security requirements, ranging from controlling visitors to documenting security policies for the information and compliance of everyone in the organization.
Requirements to Regularly Monitor and Test Networks
10. Log and monitor all access to system components and cardholder data.
- Compliance Example 10: The company maintains a logging mechanism to track user activities. This is especially critical for managing vulnerability and for after-the-fact forensics in the case of a security breach.
11. Test the security of systems and networks regularly.
- Compliance Example 11: The company strengthens its defenses by regularly conducting penetration tests and vulnerability scans. They perform both internal and external network scans quarterly. Additionally, they schedule further scans whenever the network configuration changes to identify any new vulnerabilities.
Requirement to Maintain an Information Security Policy
12. Support information security with organizational policies and programs.
- Compliance Example 12: The company maintains a published security policy to manage security risks effectively. They actively review this policy annually, alongside conducting a comprehensive risk assessment process. This process incorporates an incident response plan, with all documents reviewed quarterly.
Note: The PCI DSS Quick Reference Guide includes detailed action items following each requirement.
How Do You Evaluate PCI DSS Compliance?
Insight Assurance’s Security and Compliance Audit Services is your pathway to payment card security and compliance. Contact us and see how our comprehensive PCI DSS consulting can bring your business into full compliance.
