Does Your Business Require PCI DSS Compliance?

 

 

Covering more on this, we have explained who and why businesses need to comply with PCI DSS standards.  

PCI compliance is a standard enforced and applicable to organizations of all sizes, including small businesses that collect, transmit, or store sensitive payment card data. Businesses that fall in scope are required to abide by the 12 PCI DSS requirements.  However, for those businesses not having payment card data (credit card or PII data) in their Cardholder Data Environment (CDE) they automatically fall out of scope and need not achieve PCI DSS Compliance.  

 

For organizations that fall in scope, the size of their business does not matter, but the number of debit or credit card payments the business deals with annually determines if they need to obtain PCI Compliance Level 1, Level 2, Level 3, or Level 4. The compliance levels for merchants, such as online retailers are explained below- 

 

 

• Merchants who process more than 6 million credit or debit card transactions annually, including in-store, online, or a mixture of both.

• Any merchant that Visa determines should be a Level 1 merchant to minimize risks to the Visa network.

• Merchants who need to obtain Level 1 compliance are required to submit a Report on Compliance (ROC) to prove that they are compliant, which must be validated by a Qualified Security Assessor (QSA)

 

 

• Merchants who process between 1 million and 6 million credit or debit card transactions per year including both in-store and  online.

 

 

• Merchants who process 20,000 to 1 million credit or debit cards from e-commerce transactions annually. 

Level 4 Merchant

• Merchants who process less than 20,000 e-commerce transactions annually

For the service provider who is basically business entities and not a payment brand, directly involved in the processing, storage, or transmission of cardholder data may fall in either of the below mentioned two levels

 

 

• Service providers who process over 300,000 credit card transactions per year.

• Service providers who need to obtain level one must submit a Report on Compliance (ROC) to demonstrate that they are compliant, which must be signed by a Qualified Security Assessor (QSA).

 

 

• Service providers who process less than 300,000 credit card transactions per year.

 

It is important to note that only Level 1 merchants and service providers are required to have their PCI compliance validated by a Qualified Security Assessor (QSA). All others can self-evaluate their compliance by performing a Self-Assessment Questionnaire (SAQ) and submit an Attestation of Compliance (AOC). However, all Merchants and Service Providers are still required to have proper data security components in place.  

Most high-profile data breach cases are rooted in stolen credit and debit card information in the retail and service industries. So, to tackle such potential threats the PCI Council enforced the PCI DSS standard for added security. Businesses that fall in scope and do not comply with the standard may have to face huge penalties which may range from anywhere from $5,000 to $100,000 per month. Moreover, the business may end up getting its license for payment processing services revoked.

 

 

Complying with PCI DSS opens new opportunities for the organization to grow its business. Knowing that the business is PCI Compliant, here are some benefits that they will surely enjoy:-

 

• Opportunity to work with payments processors to create a new online marketplace and grow revenues. 

• Demonstrate to customers the organization’s efforts towards data security and assures safe online transactions. 

• Minimizes the risk and impact of potential threats and data breaches.

• Establishing a PCI Compliant environment can be seen as an investment for future business growth which cannot possibly be achieved without having a secure IT infrastructure and data security.

 

Conclusion 

 

The purpose of enforcing PCI DSS is to protect sensitive card information. Plus knowing that the Merchant with whom the customers are dealing is PCI DSS compliant gives them the satisfaction that their data is secure. For all these reasons, businesses that fall in the scope of PCI DSS Compliance should meet the standard requirements and achieve compliance. 

 

 Narendra Sahoo is an Information Security & Compliance expert and is Director of  VISTA InfoSec

 

 

One Million Stolen Credit Cards Hit The Dark Web: