How to Become PCI Compliant

Before a merchant or acquirer ponders PCI compliance, it is important to understand which entities PCI compliance applies to. While it is very likely that for each merchant or acquirer, PCI compliance will be mandatory, it is important to remember that it is only required if you are receiving, storing or processing the Primary Account Number (PAN) or the main credit card number of the customer, which is usually no longer than 19 and no less than 16 digits in length. In addition, a merchant or acquirer must remember that if a PAN is being stored or processed, the other information such as CVV/CVC and card holder information must be protected as well.

For a merchant to become PCI compliant, the merchant has to assess the merchant level relevant for the PCI guidelines, as each different merchant level will have different requirements. In addition, both VISA and MasterCard have certain PCI guidelines in addition to the PCI DSS standard, which need to be adhered to. Discover and American Express follow the PCI DSS standard in addition to a ‘good practices’ handbook, while there are no specific additional requirements. However, in general, the process will begin with the merchant or service provider assessing the validation level, as each different level will involve different audit, questionnaire and network scan requirements.

It would seem obvious that Level 1 merchants occupy the bulge bracket of hacker activity, but it’s actually Level 4, since there merchants tend to be smaller and occupy around 99% of the total market share of credit card transactions, as per estimates by VISA. These merchants tend to be more prone to hacker attacks primarily because they are small and usually do not possess the high end technical infrastructure as mandated by the PCI DSS. To that end, VISA requires that all Level 4 merchants submit a PCI compliance plan. In addition, the level 4 merchant must ensure that in case they are using a point of sale terminal, the terminal must be compatible with PABP and PIN requirements.

Validation levels apply to service providers as well. Service provider levels are categorized differently by MasterCard and Visa, though the emphasis in both cases is on the volume of transactions. For instance, for a Level 2 service provider, VISA prescribes the number of transactions transmitted as more than 100,000 annually, PLUS those who are not in Level 1. MasterCard simply prescribes that Service Providers who transmit on behalf of Level 1 merchants are Level 1 service providers.

The merchant or service provider must build an infrastructure in terms of firewalls, access control systems and data encryption that comply with the PCI DSS. The 1.1 standard issues the following directives for merchants to ensure that they are in compliance with the PCI standards[1]:

1. Install and maintain a firewall configuration to protect cardholder data.
2. Do not use vendor supplied defaults of system passwords and other security parameters
3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across open, public networks.
5. Use and regularly update anti-virus software or programs
6. Develop and maintain secure systems and applications
7. Restrict access to cardholder data by business need-to-know.
8. Assign a unique ID to each person with computer access
9. Restrict physical access to cardholder data
10. Track and monitor all access to network resources and cardholder data
11. Regularly test security systems and processes
12. Maintain a policy that addresses information security for employees and contractors.

Once the technical infrastructure is in place, the merchant or service provider must locate an Approved Scanning Vendor (ASV), who will conduct a network scan to ensure that the safety requirements highlighted above are actually functional and not just placeholders in the self-assessment questionnaire required for Level 2, 3 and 4 merchants and service providers. The purpose of the scan is to locate vulnerabilities in the system that can lead to data breaches and diagnose & recommend measures to fix these problems. The ASV submits a report to the PCI highlighting the potential security holes and the level of vulnerability from 1-5 (but this time, a Level 5 is the highest point of vulnerability). In case of a level 1 merchant, an on site assessment is also mandated by the PCI, to be conducted by a Qualified Security Assessors (QSAs).

Finally, a self-assessment questionnaire on a prescribed format needs to be submitted to the acquiring bank by the processor &/or merchant service provider, which acts as a checklist to ensure that the 12 requirements outlined above have been addressed and met. Some experts believe that PCI compliance has less to do with network and information security, than it has to do with compliance. For one thing, a merchant only needs to be 100% compliant at the time of the review- this loophole can make a merchant lax throughout the year, and only fix up the security holes during the time of the review or audit. That won’t solve any security crises, only make them worse.

---

[1] PCI security council

ABOUT THE AUTHOR:

Jennifer Loganathan is the President and CEO of Stradafee Limited. Stradafee is a leading international payments company based in New York. Stradafee is a retail and ecommerce payment processing provider specializing in international and domestic merchant account solutions. Stradafee also offers check processing, high risk merchant accounts, offshore merchant account, and high volume merchant account options. Stradafee can help businesses of all industries and sizes. For more information on credit card processing and check processing please visit www.stradafee.com.

Tags: 21, account, accounts, ACH, business, card, cards, check, Credit, Credit Card Processing, data security, drafts, E-Commerce Merchant Account, ecommerce, high risk, High Risk Merchant Account, high volume, high volume merchant account, international, internet, internet merchant account, merchant, merchant account, multi-currency, offshore, offshore merchant account, Online, pci compliant, pci security, processing, provider, retail, service, services, stradafee