Does your business take credit card or debit card payments? If so, you should make sure you meet PCI DSS compliance standards.

Here’s a look at PCI DSS’s meaning, its requirements and what it takes to achieve compliance.

What is PCI DSS Compliance?

PCI DSS stands for Payment Card Industry Data Security Standard. It’s a set of rules aimed at making card payments safer and keeping the risk of fraud as low as possible. The guidelines set out how you should store, transmit and process your customers’ credit and debit card information.

PCI DSS came to be in 2006. At the time, e-commerce had just started booming. But lax security standards meant card fraud was at all-time highs.

During 2006, for instance, British consumers lost £212.7 million to online fraud. So, the five biggest card schemes in the world — Visa, MasterCard, American Express, Diners’ Club and JCB — got together to make online payments safer.

The result was the PCI Security Standards Council. This Council administers the PCI DSS standards.

As then Chairperson Seana Pitt explained:

“The payment brands that founded the Council are committed to ensuring the ongoing development of data security standards that are both efficient and effective. The creation of this Council is a significant step forward in protecting cardholder information and it underscores the critical nature of this effort.”

Is PCI DSS Compliance Required by Law?

No. PCI DSS compliance isn’t a legal requirement in the UK. That said:

●     The vast majority of UK banks and financial institutions comply. And this means it’s in your best interest to abide too.

●     Credit and debit card data isn’t just financial information. It’s also personal data. Keeping personal data secure is a legal requirement under the General Data Protection Regulation (GDPR)

The upshot is that not complying with PCI DSS requirements has several serious consequences. In particular:

●     Banks risk fines for security breaches. If you’re not PCI DSS-compliant, they can pass on these fines to you. Penalties can range from £3,000 to as much as £60,000

●     You could get charged higher payment processing fees to make up for the added risk or even banned from accepting card payments.

●     Suffered a data breach? The Information Commissioner’s Office will take into account whether you’re PCI DSS-compliant when investigating if you’re to blame and how much to fine you.

●     Customers won’t buy from a website they don’t trust. In one study, 77 percent of consumers said they’d think twice about shopping from a site that didn’t have the green padlock in the address bar.

What are PCI DSS Requirements?

PCI DSS is made up of 12 requirements. These requirements are then split into six groups called ‘control objectives’. The control objectives are to:

●     Build and maintain a secure network and systems

●     Protect cardholder information

●     Create a Vulnerability Management Programme

●     Put in place strong access control measures

●     Monitor and test networks regularly

●     Put an information security policy in place

Let’s have a more in-depth look at each of these objectives in turn.

Building and maintaining a secure network and systems

To meet this requirement, you’ll need to do two things:

●     Store cardholder information, that is names, card numbers, billing addresses and so forth, securely

●     Never use the default passwords and security parameters your software and hardware comes pre-installed with

PCI DSS standards specify that you should store sensitive data behind a firewall. But this doesn’t necessarily mean you have to set one up on your local network. In fact, to make sure the data is as safe as possible, you should:

●     Partner with a PCI DSS-compliant payment processor. Companies such as Stripe and Square can process card payments and also store card data securely on your behalf.

●     Collect card data using secure forms. Card-on-file, for instance, passes on card data to your PCI DSS-compliant payment processor for secure storage. Note that text fields aren’t PCI DSS-compliant, even if they’re encrypted. You’ll need a card-specific field.

●     Get your customers’ permission before storing their details. You should never store card details — or any other personal data — without your customers’ express consent.

●     Only store the least amount of information necessary to complete the transaction. You should also make it clear to your customers what information you’re collecting, where you store it and what you use it for.

The second requirement is pretty straightforward. Change system passwords regularly. And try making them as secure as possible. In particular:

●     Avoid short passwords, as these are easier to guess. As a rule, aim for at least six characters.

●     Use a mix of small letters, capital letters, numbers and special characters, such as exclamation marks and hash signs.

●     Avoid memorable words and phrases. Think you might forget a meaningless password? Use a secure password utility such as LastPass or 1Password.

●     Never, ever reuse an old password.

Protecting cardholder information

To meet this requirement, you’ll need to:

●     Protect any stored card data

●     Make sure sensitive data is encrypted when you transmit it across the internet

Here again, your PCI DSS-compliant payment processor can come to the rescue by storing card data and handling payments securely on your behalf. That said, you’ll also want to make sure your website is set up securely.

In particular, it should have a TLS 1.2 (Transport Layer Security version 1.2) certificate.