Are you ready for PCI compliance?

Davey Winder takes a closer look at the financial transaction security standard and what you need to do to get certified.

"As such your merchant services organisation has typically stipulated in its merchant service contract that you should be in compliance with applicable scheme compliance programs which includes PCI DSS. PCI DSS is being codified into State Law in the US since 2007 and will likely be codified into Federal law within two years. At that stage the EU is very likely to follow suit so the advice is to get ready now".

At the end of the day, this is not a matter where business can afford to be choosy; not that it has a choice as compliance is mandatory anyway. Far better to get with the program and become compliant than risk either having the credit card company remove your privileges as it were, fine you for non-compliance or, worse case scenario, suffer a high profile data breach that irrevocably damages your reputation, brand and ability to remain competitive.

Even when budgets are being squeezed, PCI compliance is not an area where you can afford to cut corners.

Businesses should think of it as a marketing opportunity, a chance to show their customers and business partners alike that they take security seriously.

Advertisement - Article continues below
Advertisement - Article continues below

As Dr Graham Oakes, author of a book entitled 'Project Reviews, Assurance and Governance' rather succinctly told IT PRO when asked what companies that are not yet PCI compliant need to do: "If they're not seriously on the way to compliance now, then the main thing they need to do immediately is prepare a good excuse..."

The 12 core requirements of PCI-DSS compliance

According to the PCI Security Standards Council, the 12 core compliance requirements are:

Build and maintain a secure network

Requirement 1: Install and maintain a firewall configuration to protect cardholder data

Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

Advertisement - Article continues below

Protect cardholder data

Requirement 3: Protect stored cardholder data

Requirement 4: Encrypt transmission of cardholder data across open, public networks

Maintain a vulnerability management programme

Advertisement - Article continues below

Requirement 5: Use and regularly update anti-virus software

Requirement 6: Develop and maintain secure systems and applications

Advertisement - Article continues below

Implement strong access control measures

Requirement 7: Restrict access to cardholder data by business need-to-know

Requirement 8: Assign a unique ID to each person with computer access

Requirement 9: Restrict physical access to cardholder data

Regularly monitor and test networks

Requirement 10: Track and monitor all access to network resources and cardholder data

Advertisement - Article continues below

Requirement 11: Regularly test security systems and processes

Maintain an information security policy

Requirement 12: Maintain a policy that addresses information security

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now

Most Popular

Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020

Dell XPS 13 (New 9300) hands-on review: Chasing perfection

14 Jan 2020
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020