PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards developed by major brands from payment card industries like VISA, Mastercard, and JCB International in 2004. This standard is governed by the Payment Card Industry Security Standards Council (PCI SSC) to ensure the protection of cardholder data.
Organizations should think of it as traffic signals for handling card data, ensuring it flows smoothly and securely. Businesses that accept, transmit, or store card information regardless of the transaction volume, need to comply to avoid hefty fines and reputational damage.
Following PCI DSS Compliance primarily helps in 3 things;
- Prevent data breaches and leaks of sensitive cardholder information.
- Minimize the risk of fraud and financial loss for both businesses and customers.
- Maintain trust with customers by demonstrating a commitment to data security.
PCI DSS 12 requirements for handling cardholder data
There are in total 12 requirements that complete PCI DSS compliance. Here we are discussing 4 major areas that build a crucial foundation for PDICSS compliance. Remember, focusing on these key areas and implementing the shared controls reduces the risk of a data breach and gets you started with PCI DSS compliance.
Let us look at all the key areas one by one;
Cardholder Data Protection
Encryption
- Encrypts cardholder data at rest (stored on databases or servers) using strong algorithms like AES-256.
- Encrypt data in transit (traveling over networks) using secure protocols like TLS/SSL.
Secure Storage
- Implement secure storage methods like dedicated databases or hardware security modules (HSMs) for cardholder data.
- Restrict physical access to storage locations through appropriate security measures.
Restricted Access
- Limit access to cardholder data to authorized personnel based on the principle of least privilege.
- Implement robust user access controls with strong authentication mechanisms like multi-factor authentication (MFA).
Access Control Measures
Least Privilege
- Grant users only the minimum access permissions necessary to accomplish their job.
- Do not grant excessive privileges and reduce the potential impact of compromised accounts.
Strong Authentication
- Implement multi-factor authentication (MFA) for all access attempts to cardholder data systems.
- MFA adds an extra layer of security, requiring additional verification beyond just a username and password.
Activity Monitoring
- Continuously monitor user activity within systems containing cardholder data.
- Identify and investigate suspicious activity promptly to detect potential security incidents.
Secure Network Systems
Firewalls
- Implement firewalls to filter incoming and outgoing network traffic, blocking unauthorized access to sensitive systems.
- Regularly update firewall rules to maintain effectiveness against evolving threats.
Intrusion Detection/Prevention Systems (IDS/IPS)
- Deploy IDS/IPS to detect and potentially block malicious activity on your network in real-time.
- These systems continuously monitor network traffic for suspicious behavior indicative of attacks.
Regular Security Assessments
- Conduct regular internal and external security assessments to identify vulnerabilities in your network infrastructure and applications.
- Proactively address identified vulnerabilities to prevent attackers from exploiting them.
Encrypted Data Transmission
Secure Protocols
- Require the use of secure protocols like TLS/SSL (Transport Layer Security/Secure Sockets Layer) for all communication involving cardholder data.
- TLS/SSL encrypts data in transit, making it unreadable even if intercepted by attackers.
Certificates and Validation
- Securely manage and validate digital certificates used for secure communication channels.
- Ensure only valid and trusted certificates are used to prevent potential man-in-the-middle attacks.
Data Minimization
- Collect, store, and transmit only the minimum amount of cardholder data necessary for business purposes.
- Reduce the attack surface by minimizing the amount of sensitive data readily available within your systems.
What are the four levels of PCI DSS Compliance?
The PCI DSS compliance which is divided into four parts is primarily divided based on the annual transaction volume of business processes. Below is a brief classification of what a business is required to do in order to stay compliant.
Level 1: Merchants processing over 6 million card transactions annually
- Onsite assessment by an approved Qualified Security Assessor (QSA)
- Completion of a Report on Compliance (ROC)
- Quarterly network scans by an Approved Scanning Vendor (ASV)
Level 2: Merchants processing 1 to 6 million card transactions annually
- Annual completion of a Self-Assessment Questionnaire (SAQ)
- Quarterly network scans by an Approved Scanning Vendor (ASV)
- May be required to undergo an onsite assessment by a QSA at the discretion of the payment brands.
Level 3: Merchants processing 20,000 to 1 million card transactions annually
- Annual completion of a Self-Assessment Questionnaire (SAQ)
- Quarterly network scans by an Approved Scanning Vendor (ASV)
Level 4: Merchants processing fewer than 20,000 card transactions annually
- Annual completion of a Self-Assessment Questionnaire (SAQ)
- Quarterly network scans by an Approved Scanning Vendor (ASV) (may be eligible for a simplified compliance process depending on how they process payments)
Before you act upon the above-shared requirements, understand and note the following things;
Self-Assessment Questionnaires (SAQs) are the tools provided by PCI SSC to organizations to validate their compliance depending on the level (as above) and how they handle cardholder data. Refer to the files attached below.
- https://listings.pcisecuritystandards.org/documents/SAQ-InstrGuidelines-v3_2_1.pdf
- https://listings.pcisecuritystandards.org/documents/SAQ_A_v3.pdf
For businesses, make sure you determine the correct merchant level based on annual card transaction volume. In case of any misleading information, a business can land in a non-compliance state and may be charged with hefty fines. Once again, remember that PCI DSS is a mandatory standard for all the merchants who store, process, or transmit cardholder data.
What if PCI DSS Compliance is expired or inactive?
Many a time it happens where our teams often get asked this question “What if PCI DSS Compliance is expired or inactive?”. And our simple response is “That it simply means, an organization is no longer in compliance with PCI DSS standards” and there could be several reasons for this. Unfortunately, each reason comes with its consequences. We have tried to capture the most common reasons and consequences for expired or inactive PCI DSS compliance.
Reasons for Inactive/expired Compliance
- Failure to renew compliance: Remember what we have said above? PCI DSS requires annual Qualified Security Assessor (QSA) assessments to verify adherence to the standards. When an organization (due to any reason) fails to undergo this assessment or renew its compliance, its status becomes inactive or expired.
- Non-compliance issues: During a QSA assessment, critical vulnerabilities and non-compliance issues are identified. The organization’s status becomes inactive/expired. Thoroughly addressing the issues and after successful reassessment, organizations can regain their compliance status.
- Change in business model: In case of any circumstances like a change in business model, where organizations no longer store cardholder’s details. In such cases, PCI DSS compliance might become irrelevant. However, proper handling of any remaining data and potential compliance obligations still need attention.
Consequences of Inactive/Expired Compliance
- Fines and penalties: Payment card banks and issuing banks can impose hefty fines on organizations that fail to comply with PCI compliance requirements.
- Reputational damage: A data breach that results from non-compliance damages the reputation of an organization. This may lead to customer retention, customer loss, lack of trust, and potential business opportunities.
- Card processing restrictions: Payment card brands have complete authority to restrict or terminate an organization’s right to process card payments if they do not comply with PCI DSS standards.
The above are the immediate possible reasons and consequences in case of inactive/expired compliance. You may want to ask if there are any action steps that organizations can take to regain their compliance. Yes, fortunately, there are a few steps that organizations can follow. Although it can be a painful process, it’s worth it!
Regaining compliance
- Address identified issues: Identify and address all non-compliance issues identified during the QSA assessment or through self-evaluation. This may involve patching vulnerabilities, implementing missing control measures, or updating security policies.
- Undergo reassessment: The identified issues must undergo a new assessment by a QSA to confirm the compliance with latest PCI DSS requirements.
- Maintain continuous compliance: Put a plan in place to maintain the ongoing security posture and in return maintain the compliance standard. This involves and is not limited to continuous monitoring, regular security assessments, vulnerability scanning, and adherence to updated security best practices.
