All organisations that store, transmit or process cardholder data must fulfil a number of requirements as part of the Payment Card Industry Data Security Standard (PCI DSS). These requirements aim to keep cardholder data secure during the process of storing, transmitting and processing cardholder data and provide a consistent framework for keeping data secure at the global level. Breaches of information have been a common problem for many years. They pose a serious threat to both organisations and card owners. The PCI DSS is applicable to merchants, service providers, issuers, processors and all other third parties.
Merchants are divided into four levels based upon their annual transaction volume, as defined by both Visa Inc. and MasterCard. Transaction volume includes all debit, credit and prepaid transactions carried out by a merchant. Here are the four levels:
| Merchant Level | Criteria |
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
Service providers are divided into two levels. According to MasterCard, any Third Party Processor (TPP) is considered as a Level 1 Service Provider, while Data Storage Entities (DSEs) are considered as Level 1 or 2 Service Providers, depending upon their annual volume of MasterCard transactions. For Visa Inc., all service providers that store, process and/or transmit Visa transactions are ranked as level 1 and 2.
| Service Provider Level | Criteria |
| 1 | Mastercard:
Visa:
|
| 2 | Mastercard:
Visa:
|
Every merchant and service provider must fulfil at least two validation requirements to authenticate their compliance with the PCI DSS. Validation requirements for each level can be best understood as follows:
| Merchant Level | On-Site Security Audit by QSA | Network Scan by ASV | Self-Assessment Questionnaire | 3rd Party Payment Application Validation |
| 1 | Required Annually | Required Quarterly | Required if applicable | |
| 2 | Recommended Annually | Required Quarterly | If a QSA audit is not performed, an SAQ is required annually | Required if applicable |
| 3 | Required Quarterly | Required Annually | Required if applicable | |
| 4 | Required Quarterly | Required Annually | Required if applicable |
| Service Provider Level | On-Site Security Audit by QSA | Network Scan by ASV | Self-Assessment Questionnaire | 3rd Party Payment Application Validation |
| 1 | Required Annually | Required Quarterly | Required if applicable | |
| 2 | Recommended Annually | Required Quarterly | If a QSA audit is not performed, an SAQ is required annually | Required if applicable |
The aim to develop the PCI DSS was to enforce secure controls for cardholder data and to reinforce the consistent and worldwide adoption of these security controls. An overview of its 6 security controls and 12 requirements is given below:
| Security Control | Requirement |
| Build and Maintain a Secure Network and Systems |
|
| Protect Cardholder Data |
|
| Maintain a Vulnerability Management Program |
|
| Implement Strong Access Control Measures |
|
| Regularly Monitor and Test Networks |
|
| Maintain an Information Security Policy |
|
As already mentioned, it is mandatory for all merchants, service providers and third parties that are involved in storing, processing or transmitting cardholder data to comply with the PCI DSS. Without compliance, these organisations cannot carry out their credit or debit card activities. Although the PCI Security Standards Council manages the PCI DSS, every card brand has its own strategy to enforce compliance on its clients. Requirements for validation of compliance vary for each card brand, but in general, the level of the organisation determines what path should be taken to achieve PCI DSS compliance.
Usually the following steps must be taken by an organisation in order to achieve PCI DSS compliance:
Achieving PCI DSS compliance can be a daunting process, but will be much worse if a proper scoping exercise is not done before starting to complete the requirements. It is very important for organisations to understand and minimise the scope of the PCI DSS in order to make the process as easy as possible. The Cardholder Data Environment (CDE) forms the scope of the PCI DSS and consists of the processes, people and technology used for storing, processing and transmitting cardholder data. Similarly, all system components are also included in the scope. These consist of servers, network devices, computer systems, applications and any other components that are connected to cardholder data.
Once the scope is defined, it must be checked for accuracy to ensure that all flows and locations of cardholder data are included in the scope. The following steps should be carried out:
Once an organisation has taken all necessary measures to implement the PCI DSS on its systems, it needs to hire the services of a Qualified Security Assessor (QSA) to conduct on-site compliance verification and security assessment. QSA firms are trained and also certified by the PCI SSC.
The QSA serves to verify a merchant’s compliance to the PCI DSS by filling out a Report on Compliance (ROC), which is then sent to the acquiring bank of the merchant. The bank then sends it to the relevant credit card company to verify compliance.
Always select a QSA that has past experience of working with similar organisations and understands your business well. Also, maintaining goodwill and a long-term relationship with your QSA is important to help you with ongoing vulnerability assessments and remediation measures.
StickmanCyber has been certified by the PCI Security Standards Council as a Qualified Security Assessor for the PCI DSS. This was made possible with the help of a hardworking and experienced team, after thorough inspection and scrutiny by the PCI Security Standards Council. We carry out certifications and assessments for merchants, service providers, acquirers and issuers in the Asia-Pacific, Africa and the Middle East.
As a company certified as a Qualified Security Assessor, we can help you to:
At Stickman Consulting, we ensure that our clients are equipped with the necessary knowledge, tools and processes that are needed to develop a secure network. Our specialist team of consultants have years of experience in providing services to banks, government, service providers and retailers.
Is your business looking to get PCI DSS compliant? StickmanCyber's PCI DSS compliance service deploys a 5-step methodology to help you build trust with your customers and guarantee secure transactions with PCI DSS Compliance.