As from the 1st October 2009 PCI Compliance has become law and merchants must have these measures in place. Failure of merchants (eg online shops) to meet compliance standards can result in fines from credit card companies and banks, and even the loss of the ability to process credit cards. It can also increase your PCI category level which makes compliance in future more expensive and time consuming.
The Basics of PCI Compliance and Validation Regulations
The payment card industry compliance and validation regulations apply to financial institutions, Internet vendors and retail merchants. The rules spell out what security measures must be taken to protect the private information of employers and employees during any transaction occurring with the use of a paycard. They also require certain auditing procedures. The Payment Card Industry Data Security Standard is used by all card brands to assure the security of the data gathered while an employee is making a transaction at a bank or participating vendor.
There are six categories of PCI compliance security standards.
Build and Maintain a Secure Network
Requirement 1: Install and maintain a firewall configuration to protect cardholder data
Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data
Requirement 3: Protect stored cardholder data
Requirement 4: Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program
Requirement 5: Use and regularly update anti-virus software
Requirement 6: Develop and maintain secure systems and applications
Implement Strong Access Control Measures
Requirement 7: Restrict access to cardholder data by business need-to-know
Requirement 8: Assign a unique ID to each person with computer access
Requirement 9: Restrict physical access to cardholder data
Regularly Monitor and Test Networks
Requirement 10: Track and monitor all access to network resources and cardholder data
Requirement 11: Regularly test security systems and processes
Maintain an Information Security Policy
Requirement 12: Maintain a policy that addresses information security
Additionally, there are four merchant categories:
Merchants with more than 6,000,000 transactions per year. Other merchants in Level 1 will be merchants whose security has been violated and data compromised and merchants which another credit card company have classified as Level 1.
Merchants with 150,000 to 6,000,000 transactions per year.
Merchants with 20,000 to 150,000 transactions per year.
Merchants with less than 20,000 transactions per year
PCI Compliance Validation
Credit card companies validate that vendors are abiding by the PCI Compliance regulations. The volume of transactions and the risk determined by the credit card company determines the validation rating for the merchants and institutions accepting credit/debit and paycards. Along with requiring participating businesses to complete a self-assessment questionnaire, MasterCard and Visa perform the following actions to validate a participating business’ security:
An on-site visit and
A network scan performed by an authorised PCI Compliance scanning vendor.
More information can be found at http://www.pcicomplianceguide.org/pci-basics.php
