Who is required to meet the PCI security standard?

< Payment Industry News Home

The Payment Card Industry (PCI) data security standards are network security and business practice guidelines instituted by VISA®, MasterCard, American Express and Discover Card. The PCI was developed to create a ‘minimum security standard’ with consideration of the protection of the cardholders accounts and transaction information.

Any vendor or entity that accepts credit or debit card payments must comply completely with PCI security standards. If they do not, they may be fined a portion of money or permanently expelled from using card acceptance programs.

All merchant banks are also required certify proof of PCI compliance from merchants that do more than 20,000 transactions per. If the merchants banks can not supply this information, they too may be fined. However, not only merchants who have more than 20,000 transactions have to meet PCI compliance.

Everyone, regardless of transaction volume must produce Certification of PCI Compliance. Merchant accounts processors need to rely heavily on adhering to the guidelines. Any bank that wants information about the card holder must comply with the PCI and are accountable for guaranteeing the compliance of all of the merchants for any payment channels they may go through. Merchants must abide to 12 basic security requirements and sub requirements.

Some of the requirements are: install and maintain a working firewall to protect data, keep security patches up to date, protect stored data, encrypt data sent across public networks, assign unique ID to each person with computer access and many more requirements.

There are two basic steps to PCI standards.

1. Pass quarterly remote vulnerability scans carried out by an a VISA® and MasterCard qualified Independent Scan Vendor such as PCI ToolKit ™ Inc. PCI ToolKit ™ uses unlimited on demand manual scans to retest systems whenever needed. It also gives detailed instructions to patch all vulnerabilities found during scans.
   
   
2. Successful completion of a security self assessment questionnaire. The questionnaire asks specific questions about your internal security practices, both on your web site and in your office.