What is PCI Compliance?

The Payment Card Industry Data Security Standard sets the bar for ensuring all businesses securely and accept, process, store and transmit cardholder data. Any business that accepts credit cards must be PCI complaint. So with that, “What is PCI compliance?”

History of PCI Compliance

The PCI Security Standards Council (PCI SSC) was created in 2006 when the internet began to become more commonplace in people’s day-to-day lives. The internet became a vital tool for businesses to be able to accept credit card transactions from anywhere. The reason the PCI SSC came into being is that the internet brought numerous new threats to people’s secure information, as a result guidelines and best practices were created to deter data theft. Those best practices and guidelines are known as the Payment Card Industry Data Security Standard (PCI DSS). The PCI SSC exists as an independent body designed to manage the PCI DSS.

Achieving PCI Compliance

Any company that accepts transactions through any of the five entities of the PCI SSC brands, which include MasterCard, Discover, American Express, Visa and JCB, must remain PCI compliant. To be PCI compliant a business that handles cardholder data must follow specific technical steps to protect cardholder data.  The steps are as follows:

Build and Maintain a Secure Network

• Requirement 1: Install and maintain a firewall configuration to protect cardholder data.
• Requirement 2: Do not use vendor-supplied defaults for system passwords.

Protect Cardholder Data

• Requirement 3: Protect stored cardholder data.
• Requirement 4: Encrypt transmission of stored cardholder data.

Maintain a Vulnerability Management Program

• Requirement 5: Use and regularly update anti-virus software.
• Requirement 6: Develop and maintain secure systems and applications.

Implement Strong Access Control Measures

• Requirement 7: Restrict access to cardholder data by business need-to-know.
• Requirement 8: Assign a unique ID to each person with computer access.
• Requirement 9: Restrict physical access to cardholder data.

Regularly Monitor and Test Networks

• Requirement 10: Track and monitor all access to network resources and cardholder data.
• Requirement 11: Regularly test security systems and processes.

Maintain an Information Security Policy

• Requirement 12: Maintain a policy that addresses information security.

For more information on PCI Compliance for Merchants or PCI Compliance for Software Providers we encourage you to download our whitepapers.