10TH OCT 2024
Have you ever wondered if there’s a set of security rules and requirements that allow debit and credit card transactions to be processed securely? Turns out there is - the PCI DSS (Payment Card Industry Data Security Standard). This set of security rules was created to protect card payments and sensitive card information from theft and fraud.
Given our shift to a cashless and digital payments ecosystem, safeguarding sensitive payment information is more critical than ever. Merchants and vendors selling products and services should know how important PCI DSS training is for their business.
The PCI DSS is part of security standards; a set of technical and operational requirements aimed at safeguarding cardholder information.
PCI DSS applies to all organizations that store, process, or transmit cardholder data. It encompasses both technical and operational system components related to cardholder information. If your business accepts or processes payment cards, compliance with PCI DSS is essential.
PCI DSS training is important because it ensures that employees and businesses know how to properly handle, process, and protect sensitive payment card data, reducing the risk of fraud and data breaches.
Here are a few reasons why it's needed:
Understanding compliance requirements: PCI DSS has specific rules, and training helps employees and business owners understand these requirements, ensuring they comply with them.
Preventing data breaches: With proper training, employees learn how to secure cardholder data, spot potential security risks, and avoid mistakes that could lead to a data breach.
Maintaining trust: Customers trust businesses to keep their payment information safe. PCI DSS training ensures everyone involved knows how to protect this data, maintaining customer trust and protecting the business’s reputation.
Avoiding penalties: Non-compliance with PCI DSS can result in hefty fines, legal action, or even the loss of the ability to process credit card payments. Training helps businesses stay compliant and avoid these penalties.
Let’s break it down:
Who must follow it? Any business that stores, processes, or transmits card data (like online stores, banks, and even small businesses that accept card payments) needs to comply.
What are the rules?: The rules include securing card data, using strong passwords, encrypting data, and regularly testing security systems.
You can get PCI DSS certification from various recognized training providers and organizations that offer courses and exams.
PCI Security Standards Council (PCI SSC) is the official body that maintains PCI DSS standards. They offer different types of training and certifications, including for Qualified Security Assessors (QSAs) and Internal Security Assessors (ISAs).
There are four PCI levels that determine your business's compliance requirements based on the volume of card transactions processed annually:
Who is it for? Businesses that process over 6 million transactions per year.
To achieve PCI DSS Level 1 compliance, businesses must complete an annual report by a qualified security assessor (QSA) or an internal security assessor (ISA). A QSA conducts an onsite audit, while an ISA is a trained team member who can act as a link with external auditors. This level has the strictest requirements, and any business experiencing a data breach involving cardholder data must also undergo an external audit.
Level 1 merchants must conduct quarterly network scans through approved vendors to identify potential security risks and complete an annual penetration test to assess infrastructure vulnerabilities comprehensively.
Additionally, they must submit an Attestation of Compliance (AOC) form to confirm compliance with PCI DSS standards.
Who is it for? Businesses that process between 1 million and 6 million transactions per year.
Merchants classified as PCI Level 2 are not required to conduct an onsite PCI audit; instead, they only need to fill out a Self-Assessment Questionnaire (SAQ). The type of SAQ varies depending on how the audit scope is defined, which affects the number of questions to answer.
However, if a vendor experiences a data breach or if the acquiring bank considers it necessary, they may have to undergo an onsite audit and submit an annual compliance report.
In addition to the SAQ, Level 2 compliance requires quarterly scans of the network by an approved vendor, an internal scan, and the completion of an Attestation of Compliance (AOC) form. An annual penetration test is also required, similar to Level 1.
Who is it for? Businesses that process between 20,000 and 1 million transactions per year.
Similar to Level 2, merchants pursuing PCI Level 3 certification must complete a Self-Assessment Questionnaire (SAQ), conduct quarterly vulnerability scans, and submit an Attestation of Compliance (AOC) form. Unlike higher levels, penetration testing is not required for this level and below, though it is recommended as a best practice for enhanced security.
Who is it for? Businesses that process fewer than 20,000 transactions per year.
Level 4 PCI compliance is the lowest audit level set by major credit card companies. It applies to businesses based on their annual transaction volume and requires that they have not experienced data breaches or cyberattacks compromising cardholder data.
The validation requirements for PCI Level 4 include completing the appropriate Self-Assessment Questionnaire (SAQ), conducting quarterly vulnerability scans of the network and submitting an Attestation of Compliance (AOC).
Although Level 4 has fewer formal requirements compared to higher levels, maintaining PCI controls and implementing necessary security measures can still be time-consuming.
The costs of PCI DSS compliance can vary widely depending on the size and complexity of the organization. For smaller businesses, the average annual cost ranges from $5,000 to $10,000, while larger enterprises may spend $70,000 to $200,000 or more. The costs generally include assessments, infrastructure upgrades, consulting fees, and ongoing monitoring.
Non-compliance can result in significant fines imposed by credit card companies and acquiring banks. Fines range from $5,000 to $100,000 per month depending on the severity and duration of the non-compliance. In cases of severe data breaches, the penalties can soar even higher, as seen with major breaches like Target’s, which resulted in an $18.5 million settlement, or Home Depot’s breach, which impacted 56 million credit cards.
Both Visa and Mastercard have their own Account Data Settlement (ADC) penalties on sellers, which can differ from region to region.
To break PCI DSS fines down:
1-3 Months of non-compliance: $ 10,000 per month for high-volume customers / $ 5,000 per month for low-volume customers.
4-6 months of non-compliance: $ 50,000 / month for high-volume customers / $ 25,000 / month for low-volume customers.
7 months+ in non-compliance: $ 100,000 per month for high-volume customers / $ 50,000 per month for low-volume customers.
Remember - no company is 100% protected against data breaches, even if it is PCI compliant.
However, the fines would be capped at $50-90 per cardholder with compromised data.
You should incentivize your PCI compliance efforts, given the quantum of fines that your payment processors and banks could impose on you in case of cardholder data breaches.
Implementing security measures and adhering to PCI standards can help businesses (especially ecommerce firms) significantly reduce the risk of data breaches and cyberattacks, ensuring a safer environment for both themselves and their customers. That’s why it is important to invest in PCI DSS training programs that can help your company achieve compliance.
