As consumers pay less with cash and online shopping keeps on getting mainstream, it is essential for businesses to choose the right payment processing solutions. However, before making a choice to invest in a reliable solution for online payments, it is crucial that businesses understand the nitty-gritty details of the Payment Card Industry Data Security Standard (PCI DSS).
The standard can help offer businesses some control over their payment data security, as well as gain the confidence of both customers and investors. Merchants can evade the hefty costs of data breaches, increasing the sustainability of their businesses.
PCI DSS in A Nutshell
The early 2000s were rife with identity theft incidents that prompted five large credit card organizations- JCB International, American Express, Visa Inc., Discover Financial Services, and MasterCard- to join hands in forming the PCI SSC (Payment Card Industry Security Standards Council). Ideally, the PCI SSC’s objective was to use a series of payment processing standards to protect their clients and businesses from the threat of data breaches and identity theft.
The organization went on to develop the PCI DSS as a way of safeguarding sensitive information.
What Is The Cost Of Non-Compliance?
Since PCI DSS is considered more of a standard than a regulation, most merchants might feel that compliance isn’t compulsory. Although non-compliance won’t result in a jail term, it can bring about repercussions that can lead to the failure of the business.
For instance, non-compliant can have to pay fines of between $5,000 and $10,000 each month, which are imposed by the acquiring banks and the card issuers. When imposed on SMBs, such fines can cripple daily operations. These fines might also negatively affect the bottom lines of large companies and enterprises that do manage to pay these fees.
Who Should Be Compliant With The PCI DSS?
Any business that accepts, stores, or transmits cardholder data ought to be compliant with the PCI DSS.
Do All Merchants Have To Meet The Same Requirements?
PCI DSS compliance isn’t the same for all merchants and will depend on the size of the business. Ideally, the expectations for smaller companies aren’t as demanding as those of large companies. It all trickles down to the business’ card transaction volumes over the period of a year. There are four compliance categories, which include:
- Level 1: this is the level for merchants whose yearly Visa transactions exceed $6 million or those merchants who are considered risky.
- Level 2: a merchant will fall into this level if they process anywhere between $1 million and $6 million yearly Visa transactions.
- Level 3: any merchant processing Visa transactions between $20,000 and $1 million each year belongs to this level.
- Level 4: This is for merchants whose yearly Visa transactions are below $20,000.
Take note that, under the standard, e-commerce merchants may not fall in similar tiers as conventional brick-and-mortar businesses.
What Is Cardholder Data?
This is any PII (Personally Identifiable Information) that links users to debit and/or credit cards. The data includes the Primary Account Numbers (PAN), cardholder name, the service code, and the expiration date.
How Can You Define The Cardholder Data Environment (CDE)?
Compliance with PCI DSS is quite strenuous due to the scoping of CDE. According to the standard, the CDE is any network or interconnection that processes, stores, or transmits cardholder data or sensitive payment authentication data. Generally, the CDE has to include all components that connect or provide support to the individual network.
This means that the CDE includes interfaces that are used to pass data around, including wireless networks. It can also involve common gadgets, like personal and corporate smartphones, tablets, or laptops that are used to connect to the system as well as servers and routers.
4 Steps to Achieving Compliance
Step 1: Catalog Data Assets
Ideally, having a comprehensive scope of PCI environments forms a great basis for creating cybersecurity policies and procedures. As such, start by identifying at-risk network devices, such as wireless networks, cellular networks, routers, point-of-sale (POS) systems, and terminals.
Step 2: Diagram Assets
Once you identify these assets, outline how information flows through the assets in the environment, while detailing every device that the data interacts with. Also, pay attention to network segmentation, to make sure that none of the sensitive data makes its way into unprotected networks. Otherwise, cybercriminals can easily access this data, and even use it to gain access to more data within your CDE.
Step 3: Establish Procedures, Policies, and Controls
This is where PCI DSS compliance comes in; the standard clearly defines the required controls. It also differentiates acceptable encryption from unacceptable ones while stressing on the need for firewalls. The standard also explains its legal encryption and cryptographic methods.
Ideally, merchants’ internal policies should outline the necessary procedures for modifying configurations and passwords for all third-party software and hardware. Merchants have to personalize their services since the default password that comes with these hardware and software solutions can easily be manipulated by hackers.
The terminal connections card-present POS POI, as a result, uses early TLS/ SSL encryption since 30th June 2018. Documenting these policies and procedures makes it easy to train current employees and recruits on how to improve a merchant’s compliance posture. Such documentation also makes auditing the business for PCI DSS compliance easy.
Step 4: Monitor CDE Protections Frequently
Other than just evaluating controls, adequate monitoring involves taking part in audits that make it easy to demonstrate the efficacy of merchants’ controls. Vulnerability monitoring should be both internal and external, as it proves that internal and external threats cannot corrupt data integrity. These steps in monitoring CDE protections make it easy for businesses to form adequate audit trails while verifying the security of the systems. For businesses to reduce the risks, monitoring ought to also include business vendors since third-party vendors too pose a great threat to the sustainability of e-commerce businesses.
Easing the Burden of PCI DSS Compliance
- Leverage third-party compliance tools that are not only easy to understand but can also be easily manipulated. The platform merchants use should surface compliance challenges easily and help with reviewing the control status.
- Second, merchants should invest in software that makes it easy to access timely, updated monitoring insights, which makes the management of risk and vulnerability dynamics quick. It should also make it easy to manage corporate-wide compliance. For instance, merchants’ compliance officers should use the software to delegate compliance tasks as well as send out reminders for overdue tasks.
- Third, merchants should focus on employee training and spread security awareness. Employees are the first line of defense against common security threats, but they can also be easy targets for attacks. Ideally, merchants should train employees on the best practices for preventing common attacks. They should also understand the role they play in improving the compliance posture of the business.
The PCI compliance process is intricate and has an overwhelming list of demands. Nevertheless, it draws the line between failed cyber-attacks and cyber-threats that can sink a business. Regardless of the stage that an e-commerce business is, with regard to its compliance journey, it is always valuable to have a reference that will aid it in steering in the right direction.
