What Is PCI Compliance?

What is PCI compliance?

PCI compliance encompasses following the requirements set forth by the Payment Card Industry Security Standards Council (PCI SSC), the organization that sets all PCI regulations. Merchants must comply with these standards no matter how many credit card transactions they conduct.

However, this may be easier said than done. The Verizon 2023 Payment Security Report found that only 43 percent of companies maintain a sustainably compliant security environment. Those found not in compliance may be subject to hefty fines.

Editor’s note: Looking for the right credit card processing service for your business? Fill out the below questionnaire to have our vendor partners contact you about your needs.

Every company that accepts credit and debit cards is required to follow PCI DSS, no matter its size (although the PCI SSC does provide help for small businesses). However, there are four levels of compliance. These levels determine the actions the organization must take to be compliant; the more transactions, the more actions necessary. These are the four levels and their requirements. 

• Level 1: Any merchant, regardless of the acceptance channel, that processes over six million Visa transactions per year and any merchant that Visa, at its sole discretion, determines should meet the Level 1 merchant requirements to minimize risk to the Visa system.
• Level 2: Any merchant, regardless of the acceptance channel, that processes one million to six million Visa transactions per year.
• Level 3: Any merchant that processes 20,000 to one million Visa e-commerce transactions per year.
• Level 4: Any merchant that processes fewer than 20,000 Visa e-commerce transactions per year, and all other merchants, regardless of the acceptance channel, that process up to one million Visa transactions per year.

12 requirements for PCI DSS

There are 12 requirements to meeting the PCI DSS:

1. Install and maintain a firewall configuration to protect cardholder data.
2. Do not use vendor-supplied defaults for system passwords and other security parameters.
3. Protect stored cardholder data.
4. Encrypt transmission of cardholder data across open, public networks.
5. Protect all systems against malware and regularly update antivirus software or programs.
6. Develop and maintain secure systems and applications.
7. Restrict access to cardholder data on a business need-to-know basis.
8. Identify and assign a unique ID to all personnel with computer access.
9. Restrict physical access to cardholder data.
10. Track and monitor all access to network resources and cardholder data.
11. Regularly test security systems and processes.
12. Maintain a policy that addresses information security for employees and contractors.

Why PCI compliance matters

Many high-profile data breaches have occurred through stolen credit and debit card information in the retail and service industries, so consumers want to know that they are doing business safely. PCI compliance doesn’t guarantee a data breach won’t happen, but it adds safeguards. 

If your business is found to be noncompliant, you could face fees of $5,000 to $100,000 per month. If noncompliance persists, your business could be stripped of payment processing services.

How to stay PCI compliant

PCI compliance is nonnegotiable if you accept credit and debit cards, but preparing for a PCI audit and ensuring that your company meets credit card compliance standards can be daunting.

Jeff VanSickel, VP CyberGRC manager at The Bancorp, provided a few tips for preparing for a PCI assessment and keeping your standards at secure levels at all times:

1. Identify all business and client data. This includes any cardholder data, its sensitivity and its criticality. Correctly defining the scope of assessment is probably the most difficult and important part of any PCI compliance program, VanSickel said. An overly narrow scope can jeopardize cardholder data, while an overly broad scope can add immense and unnecessary cost and effort to a PCI compliance program.
2. Understand the boundaries of the cardholder data environment. Monitor all of the data that flows into and out of it. Any system that connects to the cardholder data environment is within the scope of compliance and, therefore, must meet PCI requirements. The cardholder data environment includes all processes, technology, and people who store, process, or transmit customer cardholder data or authentication data. It also encompasses all connected system components and any virtualization components, like servers.
3. Establish operating controls. This measure is necessary to protect the confidentiality and integrity of any cardholder data. Cardholder data should be protected wherever it is imported, processed, stored and transmitted. It must also be properly disposed of at the end of its life span. “Backups must also preserve the confidentiality and integrity of cardholder data,” VanSickel said. “Additionally, all media must be properly disposed of to ensure the continued confidentiality of the data. Be sure to include not only the hard disks used by company-owned computer systems but also leased systems and the storage included in modern copy machines and printers.”
4. Have an incident response plan in place. When a security incident occurs, have a plan to return to secure operations as quickly as possible. This plan should define roles, responsibilities, communication requirements and contact strategies in the event data is compromised, including notification of the payment brands, legal counsel and public relations. “Ideally, companies should have a certified forensics specialist on retainer who can gather evidence and testify as an expert witness if necessary,” VanSickel said.
5. Explain and enforce security procedures. You can never be sure that employees understand security practices and behaviors that can put your business at risk. It is up to you to make sure everyone in the company, including IT specialists and upper management, is educated on PCI compliance procedures.

PCI compliance keeps your business secure

If you run a business and plan to accept credit card payments, you should be familiar with PCI compliance requirements. Taking steps to comply with these standards and protect credit card information is key to avoiding large fines — but that’s not all. It’s also essential for your financial security, as well as your customers.’ 

Natalie Hamingson and Stella Morrison contributed to this article. Source interviews were conducted for a previous version of this article.