Posted by
Share this article
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements that protect data in card-based electronic transactions, guarding against fraud.
What is PCI DSS?
The Payment Card Industry Data Security Standard (PCI DSS) is an international security standard that applies to payment systems, to protect the data involved in card-based and related electronic transactions. Considering the transition to a cashless society, the huge number of transactions each day involving card payment data is a juicy honeypot for would-be criminals looking to steal funds. The PCI DSS, created by Visa, MasterCard, JCB, American Express, and Discover, seeks to keep data safe and secure, out of the hands of these thieves.
All organisations that store, process, or transmit payment account data must comply with the standard or face fines and sanctions. Entities operating as a Point of Sale, Marchant, Service Provider, or Acquirer will need to take note of their obligations. The current version of the standard is PCI DSS v4.0. Companies requiring PCI DSS services, Tesserent can help.
What are the 6 principles of PCI DSS?
There are six main goals of the PCI DSS are to:
Build and Maintain a Secure Network and Systems (Req. 1 & 2)
Protect Account Data (Req. 3 & 4)
Maintain a Vulnerability Management Program (Req
Control Measures
Regularly Monitor and Test Networks
Maintain an Information Security Policy
What are the 12 requirements of PCI DSS?
The 12 requirements of the PCI DSS must be followed to ensure transactions are as secure as possible and comply with the standard:
Install and maintain network security controls
Apply secure configurations to all system components
Protect stored account data
Protect cardholder data with strong cryptography during transmission over open, public networks
Protect all systems and networks from malicious software
Develop and maintain secure systems and software
Restrict access to system components and cardholder data by business need to know
Identify users and authenticate access to system components
Restrict physical access to cardholder data
Log and monitor all access to system components and cardholder data
Test security of systems and networks regularly
Support information security with organizational policies and programs
What is PCI Compliance?
A PCI compliance is achieved either by a Self-Assessment Questionnaire, or a PCI DSS assessment by a Qualified Security Assessor (QSA) that results in a Report on Compliance, depending on the compliance level of the organisation. A PCI DSS audit is designed to assess adherence to the technical and administrative controls within the standard, which can then be used in remediation efforts, alongside mandatory reporting.
PCI DSS compliance levels
Merchants are classified at four different levels of compliance, depending on how many transactions are conducted in a year. Each level’s criteria may vary slightly depending on the provider (e.g. Visa, MasterCard).
Level 1: Merchants with over six millions transactions and meets the provider’s criteria.
Level 2: Merchants with between one and six million transactions and meeting the criteria.
Level 3: Merchants with between 20,000 and one million transactions and meeting the criteria.
Level 4: Other merchants.
Service providers are classified at two different levels of compliance.
Level 1: All service providers and those with over 300,000 transactions.
Level 2: All Terminal Servicers, plus AML/Sanctions Service Providers, Data Storage Entities, and Payment Facilitators with 300,000 annual transactions at Level 2.
PCI DSS benefits
Provide assurance to customers
Reduce organisational risk
Reduce the risk of data breaches
Stamp out fraud
Protecting cardholder data
Avoid fines and sanctions
Supports legal and regulatory compliance requirements
PCI DSS challenges
Identifying and defining the PCI DSS scope for organisations
Meeting the complex compliance rules of the PCI DSS
Inadequate control implementation
Changing internal systems and data handling mechanisms
Updating from an earlier PCI DSS version to version 4
Completing self-assessments correctly
Ensuring Third-party PCI compliance
PCI DSS compliance best practices
The PCI Security Standards Council has published Best Practices for Maintaining PCI DSS Compliance. Some of these best practices include:
Develop and maintain a sustainable compliance program
Develop program, policy, and procedures
Define performance metrics to measure success
Assign ownership for coordinating security activities
Continuously monitor controls
Maintain Security Awareness
Monitoring compliance of third-party service providers
Written by Smita Mylavarapu
Contact us
Speak with a Tesserent
Security Specialist
Tesserent is a full-service cybersecurity and secure cloud services provider, partnering with clients from all industries and all levels of government. Let’s talk.
![Tess head 9 min](/assets/template/_650xAUTO_crop_center-center_none/tess-head-9-min.png)