MERCHANTS MUST BE PCI-COMPLIANT

PCI compliance isn’t an option for merchants who process credit cards and store cardholder

information. The credit card associations require merchants to securely handle this information at-all-times. Merchants who fail to comply with PCI requirements can expect large fines, which can also result in canceling their ability to process payments. PCI compliance requires merchants safeguard their customers’ payment card information. This means following security requirements that include policies and procedures, software design, and network architecture.

The major credit card companies created the PCI Data Security Standard (PCI DSS) to make sure merchants adopt critical security measures. There are 12 requirements for meeting the PCI DSS, broken into 6 groups:

Build and Maintain a Secure Network
REQUIREMENT 1: Install and maintain a firewall configuration to protect cardholder data
REQUIREMENT 2: Do not use vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data
REQUIREMENT 3: Protect stored cardholder data
REQUIREMENT 4: Encrypt transmission of cardholder data across open, public networks

Maintain a Vulnerability Management Program
REQUIREMENT 5: Use and regularly update anti-virus software
REQUIREMENT 6: Develop and maintain secure systems and applications

Implement Strong Access Control Measures
REQUIREMENT 7: Restrict access to cardholder data by business need-to-know
REQUIREMENT 8: Assign a unique ID to each person with computer access
REQUIREMENT 9: Restrict physical access to cardholder data

Regularly Monitor and Test Networks
REQUIREMENT 10: Track and monitor all access to network resources and cardholder data
REQUIREMENT 11: Regularly test security systems and processes

Maintain an Information Security Policy
REQUIREMENT 12: Maintain a policy that addresses information security