A PCI audit entails detailed reviews of a company’s cardholder data environment. PCI compliance audits are carried out by Qualified Security Assessors. The QSAs examine the IT systems that process cardholder data, Point of Sale systems, and network components such as routers, firewalls, access points. The QSA will assess whether the organization adheres to the compliance standards.
To ensure that your organization is PCI compliant, your cardholder data environment has to meet the 12 high-level compliance requirements. Twelve requirements seem easy to attain, but in reality, preparation and compliance is much more complex. You also have to comply with all the 281 sub-requirements stipulated by the Payment Card Industry Data Security Standard (PCI DSS). The 12 high-level requirements seek to address customer payment information threats.
Why PCI DSS Matters
PCI compliance seeks to protect customer data, such as credit and debit card information. The PCI DSS provides the necessary guidelines that merchants can follow to become compliant. The primary purpose of PCI DSS is to prevent or reduce the risk of data loss. It provides guidelines on how to prevent, detect, and react in case of a data breach.
The late 90s saw people embrace online shopping; however, the excitement was short-lived since fraudsters were not far behind. This saw the introduction of the Cardholder Information Security Program by Visa in 1999. It was implemented two years later as a security standard for Visa’s online payments.
The other major card companies, such as Mastercard, Discover, and American Express, quickly came up with their unique security programs. However, the introduction of other security programs led to confusion, especially among merchants.
Fraud and data breaches continued to increase, which resulted in the major credit card companies convening to develop a unified set of security standards. In December 2004, the founding members of PCI- American Express, JCB International, Visa, Mastercard, and Discover Financial Services- introduced PCI DSS 1.0.
Merchants were required to comply with these standards. In 2006, PCI introduced version 1.1, which ultimately led to the formation of the PCI SSC (PCI Security Standards Council). The group was formed to oversee and update security standards.
Currently, the latest PCI DSS version is 3.2.1, which was released in May 2018. The new version saw the addition of 5 new sub-requirements that affect service providers. Attaining PCI DSS compliance demonstrates that you’re committed to protecting your customers from fraud, data breaches, and identity theft.
What’s your Compliance Level?
The PCI SSC recognizes that merchants handle varying transaction volumes. With this in mind, PCI SSC created four compliance levels that accommodate merchants, depending on their transaction volumes. The annual volume of transactions your business handles every year will determine your compliance level.
Level 1 compliance is reserved for ISPs and merchants whose annual transaction volume exceeds 6 million. This level has a few requirements, which include: a quarterly network scan, an annual ROC, a penetration test, and an internal scan.
Level 2 compliance is reserved for merchants whose number of transactions range between 1-6 million annually. Level 3 is reserved for 20,000 -1 million transactions per year, while Level 4 encompasses merchants who handle less than 20,000 annual transactions.
What’s a PCI DSS Audit?
PCI DSS audits are time-consuming but necessary. And unlike PCI assessments, PCI DSS audits are performed by external qualified security assessors. However, Level 3 and Level 4 merchants are allowed to conduct internal assessments with the help of corporate officers from their respective organizations.
The internal audit typically involves using a Self-Assessment Questionnaire, which you will find on the PCI SSC official website. Internal audits take less time compared to external audits.
These audits are expensive, but you can streamline the costs by following these steps:
- There are 12 high-level requirements and 281 sub-requirements. However, not all requirements apply to your business, thus focus only on the requirements that apply to your business.
- Minimize your scope
- Assess your systems and identify the kind of data your business is responsible for and analyze vulnerabilities in your payment systems as well as IT infrastructure. This will help you pinpoint the areas that don’t meet the compliance requirements.
- Test your controls at least once every year to ensure PCI DSS compliance.
- Ensure that the necessary documents are easily accessible for quicker audits.
Seek help and guidance where necessary
PCI DSS compliance is essential, but time-consuming and frustrating. You can reduce the workload by using compliance software. The software will handle most of the redundant tasks and streamline compliance management.
