PCI DSS
The security standard that every organization storing, processing or transmitting payment card data must follow.
In short
- It is set by the PCI Security Standards Council, founded by the major card networks.
- Its 12 requirements cover networks, data protection, access control, monitoring and policy.
- The simplest way to reduce PCI scope is to never store card numbers at all.
The Payment Card Industry Data Security Standard, or PCI DSS, protects cardholder data wherever it is handled. It applies to merchants, payment processors and service providers of every size that store, process or transmit card numbers. The current version is 4.0.1.
The 12 requirements
They are grouped under six goals:
- Secure networks and systems: network security controls and secure configurations.
- Protect account data: protect stored card data and encrypt it in transit.
- Vulnerability management: anti-malware and secure software development.
- Access control: restrict access by business need, identify users and restrict physical access.
- Monitoring and testing: log and monitor access, and test security regularly.
- Security policy: maintain policies and programs that support security.
How compliance is validated
Requirements depend on transaction volume. The largest merchants and service providers are assessed on site by a qualified security assessor. Smaller merchants usually complete a self-assessment questionnaire, whose length depends on how they accept cards.
Reducing scope
Every system that touches card data is in scope. Using a payment provider's hosted checkout or terminals, and tokenization so the business stores a token instead of the card number, keeps most systems out of scope and makes compliance far simpler.
Worked example
Shrinking the scope
An online retailer used to store card numbers in its own database for repeat customers, which put its servers, database and staff access in PCI scope. It switches to its payment provider's hosted payment fields and stores only tokens. Its assessment moves to a much shorter self-assessment questionnaire, and a breach of its database would no longer expose card numbers.