What Is PCI Compliance?

By maintaining PCI compliance, you can help defend your business against hackers who can get hold of sensitive cardholder data and use it to impersonate cardholders or steal their identity.

What is PCI compliance? A deep dive

PCI compliance definition

PCI compliance is the process of adhering to a set of requirements outlined by the Payment Card Industry Data Security Standard (PCI DSS) to ensure all companies who process, store or transmit credit card information do so in a secure environment that’s protected from bad actors like hackers.

Any merchant with a merchant ID that accepts payment cards must follow PCI compliance regulations to protect cardholder data against breaches. The requirements range from establishing data security policies for your business and employees to removing card data from your processing system and payment terminals.

With the recent update to PCI DSS v4.0, the standard now requires targeted, risk analysis each year to ensure that the business is addressing the most pressing threats to their specific payment environment.

Understanding the history of the Payment Card Industry Data Security Standard (PCI DSS)

The Payment Card Industry Data Security Standard (PCI DSS) was born just as the Internet emerged as a necessary and valuable tool for businesses of all sizes. Specifically, it was created to protect consumers and businesses who process cardholder data through the internet or connected POS systems.

As the Internet matured and e-commerce began to hit its stride, more companies began to bring their payment processing systems online. This meant connecting them wirelessly to both their physical and virtual payment terminals, like in-store POS systems and online stores. Meanwhile, consumers grew more comfortable using credit cards to make purchases both online and offline.

Where do PCI standards apply?

PCI-DSS standards apply to:

  • Card readers
  • Point-of-sale systems
  • Store networks and wireless access routers
  • Payment card data storage and transmission
  • Payment card data stored in paper-based records
  • Online payment applications and shopping carts

PCI compliance levels and requirements

Any business that accepts card payments through any of the five members of the PCI SSC (American Express, Discover, JCB, Mastercard, and Visa) must be PCI compliant.

The specific PCI compliance requirements that you’re expected to meet vary depending on the size of your business and the number of transactions you process each year.

In general, there are 12 PCI DSS requirements that you should know, including:

  1. Use a firewall. Set up and maintain a firewall (or network security control) to protect the card-processing environment.
  2. Change system defaults. Never use vendor-supplied default passwords or security settings on systems you manage.
  3. Protect stored data. Do not store sensitive cardholder data, such as the full Primary Account Number (PAN) unless absolutely necessary, and protect it with strong methods like encryption.
  4. Encrypt data in transit. Encrypt cardholder data when transmitting it across public networks (like the internet).
  5. Use antivirus technology. Protect all systems from malicious software (malware) and regularly update your anti-malware programs.
  6. Update software. Keep all operating systems and software that touch card data secure by installing all necessary security patches and updates promptly.
  7. Limit access to systems. Restrict access to cardholder data to only those employees who have a “business need-to-know.”
  8. Assign unique IDs. Give a unique ID to every person with access to cardholder data and ensure strong authentication (like Multi-Factor Authentication).
  9. Restrict physical access: Limit physical access to your payment devices, hard copies of receipts, and any systems that process or store card data.
  10. Monitor and log user activity. Track and monitor all access to network resources and cardholder data with audit logs.
  11. Regularly test security: Regularly test and audit your security systems and processes to find and fix vulnerabilities.
  12. Maintain a security policy. Document, maintain, and share a formal security policy that all employees must follow, including security awareness training.

What does it cost to be PCI compliant?

Without the support of a PCI-compliant payment processor, becoming and maintaining a PCI-compliant business can be costly, depending on the type and size of your company and the compliance level to which you are held. Costs can come from hiring approved vendors, application and licensing fees, third-party consultants, and even additional hardware and software to make you compliant.

PCI non-compliance consequences

If you don’t know the rules around PCI compliance or the consequences for being noncompliant, you’re not alone. While PCI compliance is not enforced as a law at the federal level in Canada, processing card payments over a system that’s not compliant opens you to a host of potential risks, fines, and contract violations.

PCI compliance best practices

Maintaining PCI compliance yourself requires continuous effort, testing, and reporting to stay aligned with the PCI DSS standards. As threats evolve, so do these standards, making compliance an always-on mandate for your business.

Here are some PCI compliance best practices to help you keep up:

  • Reduce your scope. Minimize the number of systems, applications, and networks that store, process, or transmit cardholder data. The smaller your Cardholder Data Environment (CDE), the simpler and less costly compliance becomes.
  • Don’t store what you don’t need. Only retain cardholder data (like a Primary Account Number or PAN) for a legitimate business purpose and for the shortest time necessary.
  • Use strong access controls. Restrict physical and digital access to the CDE on a strict “need-to-know” basis. Assign a unique ID to every individual with access and implement Multi-Factor Authentication (MFA) for all remote access into the network and all access to the CDE.
  • Secure your systems. Install and maintain firewalls and secure configurations, changing all vendor-supplied default passwords and security settings immediately upon installation.
  • Apply patches promptly. Keep all operating systems, software, and payment applications up-to-date with the latest security patches to fix vulnerabilities that hackers could exploit.
  • Monitor and test regularly. Conduct quarterly network vulnerability scans by an Approved Scanning Vendor (ASV) and regularly test all security systems and processes to ensure they’re functioning effectively.
  • Train employees. Make data security and PCI compliance a company-wide responsibility. All personnel must receive regular training on security policies, how to handle cardholder data securely, and how to spot phishing and other social engineering attempts.

PCI Compliance FAQs

What does PCI DSS compliance mean?

PCI DSS stands for Payment Card Industry Data Security Standard, which sets the requirements for organizations and sellers to safely and securely accept, store, process, and transmit cardholder data during credit card transactions to prevent fraud and data breaches.

Who needs PCI DSS compliance certification?

Although there is technically no such thing as ‘PCI certification,” sellers of all sizes, service providers, banks, and any other organization that processes credit card payments need to prove they are PCI compliant.

What are the PCI DSS compliance levels?

There are four levels of PCI compliance; each level has unique requirements for a business to validate its compliance. The level under which your business falls is based on your total annual transaction volume.

What does it cost to be PCI DSS compliant?

The fees to become PCI compliant and maintain that standing annually can range from approximately $1,500 per year to over $70,000 per year, depending on the size of your business.

Am I responsible for a PCI DSS Compliance Self-Assessment Questionnaire (SAQ)?

The PCI DSS Self-Assessment Questionnaire is a checklist ranging from 19 to 87 pages, created and distributed by the PCI Security Standards Council. It’s used as a mechanism for sellers to self-validate their PCI DSS compliance.