PCI DSS Compliance introduction explanation

PCI DSS Compliance introduction explanation

1. PCI DSS Compliance Richa Goel

2. Payment Card Industry, Data Security Standard PCI DSS

3. PCI DSS Developed by the five major card brands, to address potential areas of vulnerability and guide organizations in best practices to maintain the integrity of cardholder data. Anyone handling payment card details must adhere to. Failure to comply could result in: Significant fines from the card brands Inability to accept credit cards for payment Damage to brand/reputation

4. PCI DSS The Payment Card Industry Data Security Standard ( PCI DSS ) is a set of requirements intended to ensure that all companies that process, store, or transmit credit card information maintain a secure environment . The  PCI DSS applies to  all entities that store, process, and/or transmit cardholder data. It covers technical and operational system components included in or connected to cardholder data. If you are a merchant who accepts or processes payment cards, you must comply with the  PCI DSS . All organizations that retain, process, and transmit cardholder data, such as merchants who are members of card issuing companies and any other service providers should all consider compliance with PCI DSS.

5. History The Payment Card Industry Data Security Standard (PCI DSS) is the unified global standard for cardholder data security established by five international payment card brands (VISA, MasterCard, JCB, AMEX and Discover). This is the data security standard that multilaterally specifies requirements of security management, policies, procedures and methods, network configurations and software design to protect other cardholder data. Each of these five international payment card brands support compliance with PCI DSS and strives to promote the adoption.

6. PCI Data Security Standard What does this mean for you ?

7. What is PCI-DSS? 7

8. Background 1 /9/2006 - PCI DSS v1.1 1/10/2010 – PCI DSS v2.0 1/11/2013 – PCI DSS v3.0 The current (May 2018) version of PCI DSS is  3.2.1, released in May 2018

9. Why?

10. Verify Card Elements & Security Features

11. When processing a credit card transaction… Verify the following: The card is signed. The expiration date has not passed. The signature on the receipt matches the card signature. The receipt does not show the full 16-digit account number or card validation code.

12. 12 requirements Protect your system with firewalls Configure passwords and settings  Protect stored cardholder data Encrypt transmission of cardholder data across open, public networks Use and regularly update anti-virus software Regularly update and patch systems Restrict access to cardholder data to business need to know Assign a unique ID to each person with computer access Restrict physical access to workplace and cardholder data Implement logging and log management  Conduct vulnerability scans and penetration tests Documentation and risk assessments

13. PCI DSS Requirements

14. Compliance Levels All companies who are subject to PCI DSS standards must be PCI compliant. There are four levels of PCI Compliance and these are based on how much you process per year, as well as other details about the level of risk assessed by payment brands . At a high level, the levels are following: Level 1 – Over 6 million transactions annually Level 2 – Between 1 and 6 million transactions annually Level 3 – Between 20,000 and 1 million transactions annually Level 4 – Less than 20,000 transactions annually

15. What can I do?

16. Application PCI compliance  can be achieved by completing the Self-Assessment Questionnaire (SAQ). The test you take depends on how you integrate payment gateway and cardholder data. However ,  PCI  certification requires a severe self-audit and a special audit conducted by Qualified Security Assessor (QSA).

17. Thank You!