What is PCI DSS?

Whether you conduct transactions online or in person, every business needs to be prepared for a security breach. You need to ensure that your customers’ debit or credit card information is secured. In 2006, Visa, Mastercard, JCB International, Discover, and American Express co-founded the Payment Card Industry (PCI) Security Standards Council to help businesses and financial institutions protect themselves and others from breaches, theft of cardholder data, and fraud.

In this piece, we will review PCI compliance, why it matters, and how using a compliance system like Laika can assist you in protecting your data every step of the way.

What is PCI compliance, and why does it matter?

Payment Card Industry Data Security Standards (PCI DSS) are non-regulatory information security standards designed to counter the largest threats to your transaction security. The standards set technical and operational requirements for the processing and acceptance of payments and transactions.

Not only is compliance with these rules critical in keeping data secure, but they are also an industry standard. Merchants and service providers of all sizes are responsible for maintaining compliance with PCI DSS.

Compliance with PCI DSS is mandated and strictly enforced by payment and card companies. These organizations may have their own individual standards, so it’s important to ensure you know exactly what rules and security requirements there are for each card company before you begin to process payments.

Falling out of compliance can mean you not only put your data at risk but your company’s reputation as well.

Who needs PCI DSS compliance?

Any entity that is handling payment card transactions needs to comply with PCI DSS regulations. If your organization is new to compliance, following so many regulations can be daunting, especially if you are unsure which rules your organization needs to follow. One set of regulations does not fit all. Your journey to PCI DSS compliance will change depending on what type of entity your organization is. Examples of industries with different regulations include:

• Acquirer banks
• Cardholder banks
• Processors
• Merchants
• Other service providers

Before you begin the process of PCI DSS compliance, get familiar with the compliance standard in your industry. Then, once you are familiar with the regulations you need to put in place, it’s time to determine what level of compliance your organization needs to follow. The levels of PCI compliance for merchants are as follows:

• Level 1: Process over 6 million transactions a year across all channels
• Level 2: Between 1 and 6 million transactions annually across all channels
• Level 3: Between 20,000 and 1 million online transactions annually
• Level 4: Fewer than 20,000 online transactions a year, or any merchant processing up to 1 million regular transactions per year

12 PCI DSS baseline requirements

Depending on which level your organization falls under, the requirements for PCI compliance can vary. However, there are 12 baseline requirements for PCI DSS Compliance regardless of level:

1. Use and Maintain Firewalls to Protect Data—Utilize properly configured firewalls to protect your card data environment (CDE) and keep your customers’ data confidential.
2. Use Proper Password Protections—Avoid vendor-supplied default system passwords to protect login data.
3. Protect Cardholder Data—The most important requirement, you must know how to store sensitive cardholder data and maintain a strong encryption key management.
4. Encrypt Transmitted Data—If card data is transmitted over an open or public network, you must secure that data and prevent cybercriminals from intercepting it.
5. Use and Maintain Anti-Virus Solutions—Protect against all types of malware that can affect your systems, including workstations, laptops, and mobile devices. Anything that employees can use to access the system either locally or remotely must have anti-virus solutions installed.
6. Maintain Properly Updated Software—Maintain your software and ensure that you implement a process that allows you to identify and classify any security vulnerabilities.
7. Restrict Data Access—Your business should only provide data control access to those with the role-based authority to make changes within the system.
8. Provide Unique IDs for Access—Do not share group usernames or passwords. Every user must have a unique and complex identifier.
9. Restrict Physical Access—The physical environment of your systems that hold cardholder data must be restricted to authorized personnel only.
10. Create and Maintain Access Logs—All systems must have the ability to track all users and should be reviewed daily to look for anomalies or suspicious activity.
11. Scan and Test for Vulnerabilities— Continuously discover vulnerabilities. Regularly test all systems and processes to ensure maintained security.
12. Document Your Security Policies—Implement a detailed documenting system and maintain security policy information for all employees and other vendors. Review this information at least yearly and reaffirm with all users.

While meeting and maintaining compliance with all of these can be overwhelming, Laika can help. As a complete compliance platform that automates workflows, infosec monitoring, and vendor due diligence in one single, collaborative space, Laika can help you stay on top of all of these compliance standards and prepare for the due diligence process.

Define your card data environment

To operationally prepare for a real-world data security breach, you need to understand the scope of your CDE. Your CDE documentation forms the basis for any effective PCI compliance program. Your CDE includes POS terminals, internal or customer-facing applications, external website, internal network, and any components involved in processing card transactions.

Identify gaps and evaluate solutions

Once your CDE is defined and documented, evaluate which PCI requirements apply to your given roadmap based on industry standards. Your compliance architect helps sample, test, and identify missing controls and existing controls to be improved.

Once this has been completed, all documentation of your CDE and control environment will be delivered to you on the Laika platform. This enables you to trace, audit, and maintain your compliance data out of one centralized unit for easy accessibility. Come back and refer to this road map as your central source of truth for staying within compliance.

Your road to certification

The process of your certification depends on what level your organization is at. If you are a Level 2, 3, or 4, you can complete a Self-Assessment Questionnaire (SAQ). There are various SAQ types, and your Laika team can help you determine which one is appropriate for your organization. The SAQ covers the 12 PCI DSS compliance areas and will document your organization’s compliance posture according to the standard. Once you’ve completed an SAQ, your next step is to complete an Attestation of Compliance (AOC). Keep an AOC form in your records to prove the results of a PCI compliance assessment.

If your organization is a Level 1, your next step to compliance is a Report on Compliance (ROC). The ROC is mandatory only for Level 1 organizations going through a PCI DSS compliance audit. However, both the AOC and ROC need to be completed by a certified PCI QSA once the audit has been completed for organizations at Level 1.

Laika’s team can walk you through each of these steps to ensure you are on the right path to achieving compliance.

Stay certified in evolving requirements

Certifications and security requirements evolve to keep high standards of protection. Laika evolves and scales with you as well, offering support on an ongoing basis. We will perform workshops with your team each quarter to ensure best practices and bidirectional awareness across a number of impending changes, such as:

• Changes in any PCI security standards
• Your CDE evolving due to your product roadmap
• Any other business operational change that may bear on your compliance with PCI

Laika is your partner in continuous compliance and support.

Your end-to-end PCI compliance solution

Laika is a complete compliance platform that acts as an extension of your team. We strive to help your audits achieve stronger results and keep your business in compliance. Our team provides the tools and knowledge you need to effectively implement both technical and nontechnical measures to continue your compliance.

Curious to find out how Laika can work for you? Reach out to try a free demo of our platform today.