PCI Compliance Explained—Secure Your Credit Card Information Successfully

According to the 2023 Verizon Data Breach Investigations Report (DBIR), financial motive was the motivation for 95% of the past year’s data breaches. In today’s business world, it only takes the tap of a card or click of a button to process customer payments—and with any type of financial transaction lies the opportunity for cardholder data theft. No matter the size of your organization, if you store, process, or transmit credit card information, you’ll want to comply with the Payment Card Industry Data Security Standard (PCI DSS) in order to avoid hefty fines and most importantly, keep your customer’s data secure.

PCI DSS is a framework which serves as a baseline of protection for consumers, helping to reduce fraud and data breaches throughout the entire payment process. PCI DSS compliance involves three main components:

Handling customer credit card data from start to finish. More specifically, making sure that sensitive card details are collected and transmitted securely.
Storing data securely as outlined by the 12 security domains of the PCI DSS standard, such as encryption, ongoing monitoring, and security testing of access to cardholder data.
Validating that required security controls are in place on an annual basis. This can include security questionnaires, external vulnerability scanning services, and third-party audits.

PCI DSS Compliance Merchant Levels

PCI DSS was established by the major credit card companies, Visa, Mastercard, Discover, American Express, and JCB. While each company originally established their own merchant levels, recently the brands made it easier to understand which level your organization falls under—no matter which card brands you accept.

The general merchant levels are as follows:

Level 1: Merchants processing over 6 million card transactions per year.
Level 2: Merchants processing 1 to 6 million transactions per year.
Level 3: Merchants handling 20,000 to 1 million transactions per year.
Level 4: Merchants handling fewer than 20,000 transactions per year.

12 Requirements of PCI DSS Compliance

Protecting customer data is at the core of PCI DSS. There are twelve requirements each organization must meet in order to achieve compliance:

Install and maintain a firewall configuration to protect cardholder data.
Do not use vendor-supplied defaults for system passwords and other security parameters.
Protect stored cardholder data.
Encrypt transmissions of cardholder data across open, public networks.
Use and regularly update anti-virus software or programs.
Develop and maintain secure systems and applications.
Restrict access to cardholder data by business need to know.
Assign a unique ID to each person with computer access.
Restrict physical access to cardholder data.
Track and monitor all access to network resources and cardholder data.
Regularly test security systems and processes.
Maintain a policy that addresses information security for all personnel.

BARR’s Process for PCI DSS Compliance

BARR offers four services for organizations working toward PCI DSS compliance. BARR’s cybersecurity consulting team will work with you to get started on your PCI DSS journey and connect you with a Qualified Security Assessor (QSA) that meets your needs and can validate your compliance.

PCI Mapping

If you already have certain controls in place for other compliance reports, such as a SOC 2 report, we can identify those controls and map them to PCI DSS requirements.

Facilitated Self-Assessment Questionnaire (SAQ)

All merchants are required to complete the Self-Assessment Questionnaire (SAQ). Based on your organization’s payment card processing, we will review your environment, policies, procedures, and controls to help you understand the purpose of each question and the response needed to comply with the requirements in the SAQ.

DSS Readiness Engagement

This assessment tests your current controls against the requirements of PCI DSS to identify and address any potential issues prior to the onsite assessment.

Onsite PCI DSS Readiness Engagement

Onsite PCI DSS Assessments are required for Level 1 merchants and service providers. Following a comprehensive assessment of your environment to ensure you meet the standard, we partner with QSAs to write and submit a Report on Compliance (ROC) to the PCI Council, which validates your compliance.

How to Prepare for PCI DSS Compliance

During the readiness assessment, BARR can help you prepare by assessing your controls prior to your onsite assessment. Here are a few tips to ensure your PCI assessment goes smoothly:

Understand Your Cardholder Data Environment (CDE)

Understanding your CDE is often referred to as “requirement zero.” Maintain current network diagrams that reflect how data is transmitted, processed, and stored to ensure your assessment goes smoothly.

Understand Your Requirements

Are you a service provider or a merchant? Protect yourself from last-minute surprises by recognizing any specific requirements that may apply to your organization.

Know Your Transaction Amount

Organizations are held accountable on the number of transactions handled annually. Prepare for your audit by having these numbers readily accessible.

No matter your organization’s merchant level and number of annual transactions, the security of your customer’s data is a critical—if not the most important step in establishing and growing your business. As your partner, BARR will walk you through each step of the way to help you achieve PCI DSS compliance, ultimately protecting your organization and those you serve.