The Payment Card Industry Data Security Standard (PCI DSS),
is a technical and operational system developed by the PCI Committee, formed by internationally recognized payment brands (American Express, Discover Financial Services, JCB International, MasterCard Worldwide, and Visa Inc. International), in order to ensure data security in card payment systems.
PCI DSS is based on the transmission, processing, and storage of information within information systems, in order to ensure information security at institutions and organizations involved in card payment systems;
- Built on 6 core criteria
- 12 requirement categories
- Consisting of more than 200 control points under these 12 categories.
PCI DSS is not a standard that only covers banks; it is a standard that also covers all systems that process credit card transactions or store card data.
So what are the headings within the PCI DSS Standards?
1. Building and Maintaining a Secure Network Infrastructure
a. Installing and configuring a firewall to protect card data
b. Not using default passwords
2. Storing Card Data and Security
a. Storing card data securely
b. Sending card data encrypted over public networks.
3. Maintaining a Vulnerability Management Program
a. Keeping antivirus applications up to date
b. Developing and maintaining secure systems and applications
4. Implementing Access Control
a. Access to card data must be restricted within the company
b. Each user must have their own user code, and must log in with this user code
c. Physical access to card data must be prevented.
5. Regularly Monitoring and Testing
a. All access to card data and all access to the network must be monitored.
b. Security systems and processes must be tested continuously
6. Information Security Policy
a. A sustainable policy concerning information security must be implemented for all personnel.
What are the levels used in PCI DSS?
Although security programs follow a certain standard, e-commerce companies and other credit card acceptors are evaluated at 4 different levels based on the number of card transactions. The methods required to verify compliance differ by level.
For companies using Visa and Mastercard products, the levels can roughly be classified as follows:
– Level 1: Companies processing more than 6 million transactions per year.
– Level 2: Companies processing between 1-6 million transactions per year.
– Level 3: Companies processing between 20 thousand-1 million transactions per year.
– Level 4: Companies processing fewer than 20 thousand transactions per year.
