Adeo Group Blog

As from the 1st October 2009 PCI Compliance has become law and merchants must have these measures in place. Failure of merchants (eg online shops) to meet compliance standards can result in fines from credit card companies and banks, and even the loss of the ability to process credit cards. It can also increase your PCI category level which makes compliance in future more expensive and time consuming.

The Basics of PCI Compliance and Validation Regulations

The payment card industry compliance and validation regulations apply to financial institutions, Internet vendors and retail merchants. The rules spell out what security measures must be taken to protect the private information of employers and employees during any transaction occurring with the use of a paycard. They also require certain auditing procedures. The Payment Card Industry Data Security Standard is used by all card brands to assure the security of the data gathered while an employee is making a transaction at a bank or participating vendor.

There are six categories of PCI compliance security standards.

Build and Maintain a Secure Network

Requirement 1: Install and maintain a firewall configuration to protect cardholder data

Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data

Requirement 3: Protect stored cardholder data

Requirement 4: Encrypt transmission of cardholder data across open, public networks

Maintain a Vulnerability Management Program

Requirement 5: Use and regularly update anti-virus software

Requirement 6: Develop and maintain secure systems and applications

Implement Strong Access Control Measures

Requirement 7: Restrict access to cardholder data by business need-to-know

Requirement 8: Assign a unique ID to each person with computer access

Requirement 9: Restrict physical access to cardholder data

Regularly Monitor and Test Networks

Requirement 10: Track and monitor all access to network resources and cardholder data

Requirement 11: Regularly test security systems and processes

Maintain an Information Security Policy

Requirement 12: Maintain a policy that addresses information security

Additionally, there are four merchant categories:

Merchants with more than 6,000,000 transactions per year. Other merchants in Level 1 will be merchants whose security has been violated and data compromised and merchants which another credit card company have classified as Level 1.

Merchants with 150,000 to 6,000,000 transactions per year.

Merchants with 20,000 to 150,000 transactions per year.

Merchants with less than 20,000 transactions per year

PCI Compliance Validation

Credit card companies validate that vendors are abiding by the PCI Compliance regulations. The volume of transactions and the risk determined by the credit card company determines the validation rating for the merchants and institutions accepting credit/debit and paycards. Along with requiring participating businesses to complete a self-assessment questionnaire, MasterCard and Visa perform the following actions to validate a participating business’ security:

An on-site visit and

A network scan performed by an authorised PCI Compliance scanning vendor.

More information can be found at http://www.pcicomplianceguide.org/pci-basics.php