PCI DSS, what is it and why does it matter?

What are the PCI DSS Requirements?

PCI DSS has 12 main requirements, organised into six categories, to ensure cardholder data security.

1. 1. Build and Maintain a Secure Network and Systems
   • Install and maintain network security controls (e.g., firewalls) to protect cardholder data.
   • Apply secure configurations to all system components to prevent unauthorised access.
2. 2. Protect Cardholder Data
   • Protect stored cardholder data using encryption and other security measures.
   • Encrypt transmission of cardholder data across open, public networks to prevent interception.
3. 3. Maintain a Vulnerability Management Program
   • Protect systems and networks from malicious software using anti-virus and anti-malware tools.
   • Develop and maintain secure systems and applications through regular updates and patches.
4. 4. Implement Strong Access Control Measures
   • Restrict access to cardholder data to only those who need it for their job.
   • Identify and authenticate access to system components to ensure only authorised users can access sensitive data.
   • Restrict physical access to cardholder data to prevent unauthorized physical access.
5. 5. Regularly Monitor and Test Networks
   • Log and monitor all access to network resources and cardholder data to detect and respond to security incidents.
   • Regularly test security systems and processes to ensure they are effective.
6. 6. Maintain an Information Security Policy
   • Maintain a policy that addresses information security for all personnel to ensure everyone understands their role in protecting cardholder data.

What are the consequences of non-compliance with PCI DSS?

Failure to comply with PCI DSS can have several severe consequences:

Financial Penalties: Credit card companies can significantly fine non-compliant organisations. Until compliance is achieved, these fines can range from $1,000 to $100,000 per month.

Legal Consequences: Non-compliance can lead to legal action, including lawsuits from affected customers and regulatory bodies.

Loss of Cardholder Trust: A data breach resulting from non-compliance can severely damage your reputation, causing a loss of customer trust and loyalty.

Data Breach Expenses: In a data breach, you may incur costs related to forensic investigations, customer notifications, credit monitoring services, and more.

Additional fines and impacts from applicable laws and regulations, such as GDPR, could also occur. This could mean a fine of €20 million or 4% of Global Revenue, whichever is higher.

Increased Transaction Costs: Credit card companies may increase transaction fees for non-compliant businesses, adding to operational costs.

Loss of Merchant Account: You could lose your ability to process credit card payments, severely impacting your business operations.

Reputational Damage: Negative publicity from a data breach or non-compliance can harm your brand's reputation, making it challenging to attract and retain customers.