‍

Online payments have quickly become essential to any modern business, however, they also bring about a range of security challenges.

In 2019, payment card fraud losses reached $28.75 billion worldwide; an alarming figure that has increased even further during the global pandemic.

American Express recognised the need for a global security standard in 2006, and teamed up with other major payment card organisations to establish the Payment Card Industry Data Security Standard (PCI DSS); a series of rules and regulations that seta baseline security standard for the safety of cardholder data across the world.

The PCI DSS applies to all entities that store, process or transmit cardholder data. In other words, any organisation that accepts or processes payment cards. To date, the PCI DSS covers 193 global economies, and dictates the security requirements of countless businesses.

And while many business-owners can agree that client confidentiality and security is atop priority, especially surrounding online payments, it may seem daunting to achieve PCI compliance.

Thankfully, the PCI DSS can be summarised and easily digested in three major categories:

- Handling: The secure collection and transmission of sensitive payment card details from customers.

- Storing: The secure keeping and ongoing management of sensitive payment card details.

- Validating: Performing scheduled reviews of your security controls to ensure that they are in place and continually upholding PCI compliance.

Naturally, without PCI DSS or a similar standard governing security requirements, business-owners would have less work to do when handling card payments. However, in a “wild west” or ungoverned landscape, businesses and their stakeholders would be infinitely more open to crucial risks such as data theft and payment fraud.

Regardless of the size of your operations, all organisations that process online payment card information must adhere to the written conditions of the PCI DSS.

THE BENEFITS OF PCI DSS COMPLIANCE

Lowers the risk of a data breach

The fundamental purpose of PCI DSS is to defend against cyber criminals. By achieving PCI DSS compliance, you can inherently reduce the risk of sensitive cardholder information being stolen. Through baseline PCI requirements such as firewall implementation, encryption methods and storage policies, the risk of payment fraud and data theft against your organisation is significantly lowered.

Avoid Fines

When a vendor has failed to achieve PCI Compliance, they may face monthly fines between $5,000 and $100,000 dollars per month until compliance is achieved. The last thing that any business wants to dedicate their funds to is a compliance fine. By comparison, the funding and effort that goes into securing your payment systems and achieving PCI DSS compliance is minimal.

Gain and maintain customer trust

60% of businesses that experience a data breach fail to recover, and inevitably close shop within six months. While this can be due to direct consequences of the breach, such as a failure to recover systems or an inability to pay for a ransomware attack, often times it is simply due to the reputational harm as a result of losing customer data to cyber criminals. Having a PCI DSS certificate of compliance not only helps to prevent cybercrime against your organisation, but it also helps to establish trust between you and your customers.

Standardise and improve internal processes

The PCI DSS is administered over 12 unique requirements, and they all have some form of cross-benefit with other areas of your business. For example, a PCI-DSS compliant organisation that has deployed a firewall system in their PCI efforts is not only protecting their cardholder information, but a countless range of other internal assets outside of PCI.

Furthermore, given the constant upskilling and technological changes that one a modern business is subject to, PCI-DSS can serve as a great framework for ongoing security maintenance.

REQUIREMENTS FOR PROCURING PCI DSS COMPLIANCE

According to the latest version of the PCI DSS reference guide - v3.2.1 (July 2018) - PCI DSS compliance is separated into twelve requirements administered over six key goals as follows:

GOALS	PCI DSS REQUIREMENTS
Build and Maintain a Secure Network and Systems	1. Install and maintain a firewall configuration to protect cardholder data. 2. Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data	3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program	5. Protect all systems against malware and regularly update antivirus software or programs 6. Develop and maintain secure systems and applications
Implement Strong Access Control Measures	7. Restrict access to cardholder data by business need to know 8. Identify and authenticate access to system components 9. Restrict physical access to cardholder data
Regularly Monitor and Test Networks	10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes
Maintain an Information Security Policy	12. Maintain a policy that addresses information security for all personnel

(Data fromthe original guide can be found here)

ACHIEVED PCI DSS COMPLIANCE. WHAT’S NEXT?

Achieving PCI DSS is certainly an accomplishment, but it doesn’t start or end there. The goal of PCI DSS compliance is ultimately to ensure security and safety. It’s an ongoing process wherein business owners need to establish and follow routine checks to ensure that:

- Potential vulnerabilities or exposures of cardholder data are assessed regularly

- Any security risks or vulnerabilities located in the company’s processes or technologies are repaired

- Ongoing assessments and repairs are logged and reported on for ongoing reference

In 2020, $5.2trillion was the recorded global transaction value of digital payments. Online transactions are a prevalent part of our society, and as they become more and more integrated into our everyday lives, so does the risk of criminal activity and hacking against both businesses and their consumers.

In the same vein that you wouldn’t leave your office unlocked, it’s crucial to continually locate and repair security vulnerabilities under ongoing PCI DSS maintenance.

PATONA IS PCI DSS COMPLIANT!

TEAMIFIED PTY.LTD is now a PCI DSS compliant organisation (for Staffing Services) and we could not be happier! With the relentless determination and grit of our team members, we’ve ensured that the data of our clients is always safe and secure. To know more about the services we offer, click here.

We strive to get better each and every day and adding layers of security to the data captured by the products and services our team creates and curates for our esteemed clients.

‍

WHAT IS PCI DSS COMPLIANCE?