Getting and Staying PCI Compliant

PCI stands for Payment Card Industry, and it encompasses merchants, e-commerce, payment processors, banks, Independent Sales Organizations (ISOs) and more, all of whom must meet certain security standards in order to keep their own and other businesses safe from data breaches. These standards are not foolproof, but they are designed to safeguard companies and their customers from serious problems like identity theft, fraudulent transactions, and other losses that can compromise the success of a merchant, merchant bank, or other processing agent.

What is the Responsibility of the Business Owner?

You can obtain a complete guide to PCI compliance online or by contacting your merchant service provider. It is your responsibility to know what the Data Security Standards are, and to make sure that your transactions fall in line with those rules - whether you are using a third-party processor, handling credit cards in person, operating an online store with a shopping cart, or accepting credit cards with a wireless terminal on the go. Different rules apply to different types of businesses, so you must figure out which category fits your situation, and work from there.

You should note that having an SSL for online transactions is not sufficient when it comes to this issue. The SSL will give your customers some level of confidence about the security of your web site, but it is not enough to fully protect them from a breach of data.

Your business will need to read and answer all of the questions in the Self-Assessment Questionnaire that applies to its level of processing. You will also need to sign an Attestation of Compliance, and potentially, participate in a quarterly vulnerability scan if you are a level four or five.

What are the Categories?

There are five validation types that determine which set of DSS must be met by your particular company. Level one applies to merchants who do not conduct their sales in person but rather work over the phone, by mail, or online and who outsource their credit card processing. Level two merchants use imprint technology to take a print of the customer's card, but do not store any cardholder data. Level three is for businesses with credit card terminals that are dialed into a designated phone line. They also do not store any information about the customer or his or her method of payment. Level four companies have processing solutions that are connected to the internet but who also do not store data. Level five applies to all others. If you are not sure which category is the right one for you, contact your bank representative with your dilemma and to get the most accurate, applicable information.

Penalties for Non-Compliance

That's right, even though businesses should want to follow these rules all on their own, in order to protect themselves and their clients, there are additional, financial penalties should you fail to do so. These include large fines, the potential cancellation of your account, and if you are permitted to keep your account, increased fees and surcharges that can be very damaging to a small or mid-sized operation. Getting and staying compliant is no small matter!