To begin with, I have to define this complex acronym so that we all speak the same language. PCI-DSS () is a security standard that consists of necessary requirements to protect sensitive information on credit and debit cards. It is mandatory for all companies that accept, process or transmit credit or debit card data to maintain a safe environment.
Was launched PCI SSC (Payment Card Industry Security Standards Council) in 2006 to manage and improve the security of online payments. All major payment card brands (Visa, MasterCard, American Express, Discover and JCB) established this council as an autonomous body. It is also important to mention that this advice (PCI SSC) is not responsible for PCI DSS compliance; various payment brands and acquirers have to deal with PCI DSS compliance.
The 12 PCI DSS Requirements
PCI SSC proposes 12 requirements as a Set of rules that companies have to follow to maintain a safe environment. These are the requirements:
- Install and maintain a configuration firewalls to protect cardholder data.
- Do not use system passwords and other default security parameters provided by vendors.
- Protect stored data of card owners.
- Encrypt the data of cardholders and sensitive information transmitted over open public networks.
- Use and regularly update a antivirus software.
- Develop and maintain secure systems and applications.
- Restrict access to data based on the official’s need to know the information.
- assign a unique identification to every person who has access to a computer.
- Restrict physical access to cardholder data.
- Track access to network resources and cardholder data.
- Try regularly security systems and processes.
- Maintain a policy that contemplates the security of the information
How PCI DSS works
All merchants/companies of any size have to comply with PCI DSS requirements. Compliance includes the following steps:
- Determine what type of questionnaire self appraisal (Self-Assessment Questionnaire or SAQ) has to use your business. In elaborated by PCI you will be able to discover which one best suits the characteristics of your business.
- fill out a self-assessment questionnaire (Self-Assessment Questionnaire or SAQ) according to the instructions.
- Approve a security scan from an Approved Scanning Vendor (ASV) and have evidence of passing.
- Deliver the completed questionnaire and evidence of the scan along with other necessary documents to your acquirer
What is the PCI Self-Assessment Questionnaire
The Self-Assessment Questionnaire (or SAQ) is a method of verify if your company complies with PCI regulations and is suitable to manage sensitive data.
You have to fill in the questionnaire every year. It consists of “yes/no” questions for each PCI requirement. After you submit your answers, you get a security certificate confirming your PCI compliance. There are different questionnaires for different types of businesses depending on their mode of accepting card payments.
Because it is necessary
If your e-commerce offers the opportunity to pay with credit or debit cards, this means that your company works with sensitive data that must be protected. Your customers should feel safe when they pay on your website and you have the responsibility to ensure that transactions are carried out in a completely secure way.
PCI DSS certification can also provide some advantages for your business. For example, it increases the trust of customers and they are more likely to buy from your store. As a consequence, sales and profits also increase. If you do NOT implement PCI DSS, you will most likely encounter the following problems:
- Loss of customer trust
- reduced sales
- Fraud
- various fines
- Inability to accept payments with credit or debit cards
What happens if I am not PCI DSS compliant?
If you decide NOT to comply with PCI DSS, you have to be ready to face some consequences. For example:
- In case of fraud, you have to pay fines
- Legal issues
- loss of good reputation
- various other costs
To conclude, I want to emphasize that Security in online stores is one of the most important things. If you guarantee security, you protect your clients and yourself. Also when your customers feel safe and satisfied, they tend to buy more, which is the ultimate goal of any business.
Stay informed of the most relevant news on our news channel
Facebook Comments
Disqus