|
Your PCI DSS Compliance Requirements
What is PCI DSS Compliance?
“PCI DSS” stands for Payment Card Industry (PCI) Data Security Standard (DSS). It was developed by the major credit card companies (VISA, Mastercard, Discover, American Express and JCB) in 2004 as a guideline to help organizations that process card payments prevent credit card fraud, hacking, and various other types of card security breaches. A company processing, storing, or transmitting card numbers must be PCI DSS compliant or they risk losing the ability to process credit card payments.
Merchants and Service Providers who process over 6M Visa transactions per year are required to have an on-site audit by a Qualified Security Assessor (QSA). This only represents a small percentage of merchants accepting credit cards. All other merchants are required to complete an annual Self-Assessment Questionnaire (SAQ) and may be required to submit a compliant vulnerability scan on a quarterly basis.
Who has to comply?
The credit card companies have made it clear that ANY entity that stores, processes, or transmits cardholder data regardless of their transaction volume, are required to comply with the PCI requirements. Failure to comply with the PCI security standard may result in substantial fines or permanent expulsion from card acceptance programs. Recent studies on financial fraud have indicated that hackers are increasingly targeting small, commercial Web sites, increasing the need for all merchants and service providers to become fully compliant with the Payment Card Industry (PCI) Data Security Standard (DSS).
What if I don’t comply?
These payment card data security standards come with serious consequences. Failure to comply with PCI-DSS requirements can result in stiff penalties if your business suffers a data compromise. These include:
- Fines of up to $500,000 per data security incident
- Liability for all fraud losses incurred from compromised account numbers
- Liability for the cost of re-issuing cards associated with the compromise
- Suspension of merchant accounts
Non compliance is simply not worth the risk. It only takes one incident of data compromise to potentially put you out of business. The fines and penalties alone of a data breach are generally more than a merchant can financially bear and the business fails because of it. If the merchant looses their merchant account altogether, business failure is imminent because retail simply cannot exist without the ability to accept credit and debit cards.
How do I comply?
A completed Self-Assessment Questionnaire (SAQ) is required annually. There are four different Validation Types and you will choose the SAQ Validation Type based on the way you process credit cards. The number of questions you are required to complete will vary depending on the SAQ form – anywhere from 11-226 questions. Once the applicable SAQ is completed and you have met all requirements, including written security policies, procedures, employee handouts and training aids related to the secure handling and processing of credit card data, you will be able to access your Attestation of Compliance. Some merchants require a vulnerability scan depending on their SAQ type and the way they handle, process and/or store credit card data. If a scan is required, you will need to submit a passing scan on a quarterly basis in addition to the annual SAQ completion.
What happens if I am breached?
Currently 44 states have enacted some sort of breach disclosure law. In general, most state laws follow the basic tenets of California's original law which was enacted in 2002. Companies who are breached typically have to immediately disclose the compromise to affected customers, usually in writing. Companies must also notify their processor who will then notify the bank. At that point the payment brand, processor or bank may initiate a forensic audit on the merchant to see if the merchant was in fact PCI DSS compliant at the time of the breach. Failure of the merchant to disclose a known breach would create the appearance that the merchant is involved in the breach. This situation could put the merchant in a possible criminal defense position by not disclosing or hiding the breach.
If the forensic audit concludes that the merchant was fully compliant at the time of the breach then the merchant has a reasonable defense and has shown proper diligence in their card acceptance procedures. If the audit shows that the merchant was not actually in compliance at the time of the breach, despite having previously submitted their compliance validation documentation, the merchant is then subject to large fines, penalties, and actual damages as well as the possibility of losing their card acceptance privileges. It would be challenging for a breached merchant to survive the financial burden and reputation damage resulting from a breach let alone be able to survive as a business without their merchant account.
What do I do if I am compromised?
Visa publishes a 23 page document discussing this issue called Visa Fraud Investigations and Incident Management Procedures.
|
