My Merchant Account Blog

Payment Card Industry Data Security Standard

Sunday, December 07, 2008

The Payment Card Industry Data Security Standard (PCI DSS) is the global standard that any business of any size should abide by in order to accept credit cards.  This includes storing or processing any cardholder data.

Businesses should access any type of vulnerability that might pose a compromise of cardholder data.  This vulnerability could be in the process or transmission of the cardholder information.  It could also be when the card is given to an employee to scan. 

Once the vulnerabilities are identified, steps should be taken immediately to fix any vulnerabilities, i.e. software code and updates.  All steps should be documented and back-out procedures in place just in case.

Regular reports are required to be submitted to the acquiring bank and card associations.  A quarterly scan report is required by a Approved Scanning Vendor (ASV).  Businesses that do have a high number of transactions might also be required to have a annual on-site audit by a Qualified Security Assessor (QSA).

Complying with PCI DSS

While the card organizations came together to help form the PCI DSS council to help set the standards, each card association (brand) has its own security program for compliance:

• MasterCard Worldwide: Standard Data Protection (SDP)
• American Express: Data Security Operating Policy (DSOP)
• Discover Financial Services: Discover Information Security & Compliance (DISC)
• Visa Incorporated: Cardholder Information Security Program (CISP)
• JCB International: JCB Data Security Program

Comments

Name
URL
Email	Email address is not published
Remember Me
Comments