Founded by American Express, Discover Financial Services, JCB International, MasterCard, and Visa, Inc., the Payment Card Industry (PCI) Security Standards Council (SSC) incorporates the PCI Data Security Standard (DSS) to set technical and operations requirements to protect cardholder data. It applies to all entities that store, process, or transmit cardholder data. PCI DSS 3.2.1, released on May 2018, marks the latest version.
The PCI DSS deals with payment card data and cardholder information, including primary account numbers (PAN), credit/debit card numbers, and sensitive authentication data (SAD) such as CVVs. Each payment card company, however, has its own program for compliance, validation levels, and enforcement.
Though the PCI DSS is not the law, it applies to merchants in at least two ways: (1) as part of a contractual relationship between a merchant and card company, and (2) states may write portions of the PCI DSS into state law.
The PCI DSS consists of twelve requirements.
- Install and maintain a firewall configuration to protect cardholder data.
- Do not use vendor-supplied defaults for system passwords and other security parameters.
- Protect stored cardholder data.
- Encrypt transmission of cardholder data across open, public networks.
- Protect all systems against malware and regularly update anti-virus software or programs.
- Develop and maintain secure systems and applications.
- Restrict access to cardholder data by business need to know.
- Identify and authenticate access to system components.
- Restrict physical access to cardholder data.
- Track and monitor all access to network resources and cardholder data.
- Regularly test security systems and processes.
- Maintain a policy that addresses information security for all personnel.
If a merchant experiences a breach because of PCI DSS noncompliance, the payment card brands may impose penalties on the merchant’s acquiring bank. The merchant’s acquiring bank typically passes the cost of the penalty to the merchant. The penalty costs between $5,000 to $500,000 per month. If breaches continuously occur, card brands can revoke a merchant’s right to process transactions with their cards.
In the event of a breach, the PCI DSS does not require merchants to notify the public or even the PCI SSC. Per the PCI DSS, however, merchants have an obligation to notify their payment processor of any breach. The payment processor then shares the information with the card companies. In reality, card companies usually first notify merchants of any breach because card brands notice patterns of fraudulent transactions.
According to the 2018 Payment Security Report released by Verizon, about 46 percent of companies in Europe and 39 percent of companies in America comply with the PCI DSS. These numbers show that overall PCI DSS compliance has declined—despite its proven effectiveness in protecting systems from breach and cyberattacks. The report notes that this disparity does not necessarily show company negligence but points to other issues such as maturity of IT systems or cultural appreciation of awards and recognitions.
Failure to comply with the PCI DSS can negatively impact a company’s reputation and have significant legal repercussions. Complying with the PCI DSS remains paramount in avoiding potential breaches or cyberattacks. Follow compliance best practices to ensure PCI DSS compliance and minimize liabilities.
Leonard Wills is a presidential management fellow in Washington D.C.