1. Home
  2. Digital Security
  3. Payment Security

Payment Security

Payment Security

Payment Security

Payment Card Industry Data Security Standard (PCI DSS)

The Payment Card Industry Data Security Standard (PCI DSS) is a proprietary information security standard for organizations that handle branded credit cards from the major card schemes including Visa, MasterCard, American Express, Discover, and JCB. The PCI Standard is mandated by the card brands and administered by the Payment Card Industry Security Standards Council. The standard was created to increase controls around cardholder data to reduce credit card fraud. Validation of compliance is performed annually, either by an external Qualified Security Assessor (QSA) for organizations handling large volumes of transactions, or by Self-Assessment Questionnaire (SAQ) for companies handling smaller volumes.

Secure the cardholder data where it is captured at the point of sale and as it flows into the payment system. The best step you can take is to not store any cardholder data. This includes protecting:

  • Card readers
  • Point of sale systems
  • Store networks & wireless access routers
  • Payment card data storage and transmission
  • Payment card data stored in paper-based records
  • Online payment applications and shopping carts

The PCI 3-Step Process

  •     Assess. Identifying cardholder data, taking an inventory of IT assets and business processes for payment card processing, and analyzing them for vulnerabilities.
  •     Remediate. Fixing vulnerabilities and eliminating the storage of cardholder data unless absolutely necessary.
  •     Report. Compiling and submitting required reports to the appropriate acquiring bank and card brands.

Implementing the PCI Data Security Standard starts with scoping. This process involves identifying all system components that are located within or connected to the cardholder data environment (such an environment is comprised of people, processes, and technology that handle cardholder data or sensitive authentication data).

Security Requirements

The PCI Data Security Standard specifies 12 requirements for compliance, organized into six logically related groups called “control objectives”.

Each version of PCI DSS has divided these twelve requirements into a number of sub-requirements differently:

Control objectives PCI DSS requirements
Build and maintain a secure network 1. Install and maintain a firewall configuration to protect cardholder data
2. Do not use vendor-supplied defaults for system passwords and other security parameters
Protect cardholder data 3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across open, public networks
Maintain a vulnerability management program 5. Use and regularly update anti-virus software on all systems commonly affected by malware
6. Develop and maintain secure systems and applications
Implement strong access control measures 7. Restrict access to cardholder data by business need-to-know
8. Assign a unique ID to each person with computer access
9. Restrict physical access to cardholder data
Regularly monitor and test networks 10. Track and monitor all access to network resources and cardholder data
11. Regularly test security systems and processes
Maintain an information security policy 12. Maintain a policy that addresses information security
PCI SSC

PCI SSC