Why PCI Compliance is Important
What is PCI?
PCI is an abbreviation for Payment Card Industry. Its name really is PCI Security Standards Council but many just call it as PCI Council or simply PCI. This organization was founded by the 5 major companies for credit cards namely Visa, MascterCard, American Express, JCB and Discover.
The purpose of PCI is to have uniformed security standards for all companies that are processing transactions via credit card. Before PCI was created, each credit card company held their own set of standards. Though these standards are quite similar with each other yet they are not completely similar and uniform thus problems arise.
What is PCI Compliance?
The PCI Compliance standards are set to protect the personal information of individuals who are transacting payment with the use of a credit card. Once credit card payments are involved in an industry, whether you’re a credit card company, an eCommerce shopping cart site or a financial institution, you must comply with the standards set by the PCI Council. If not, you will pay fines and may even lose the advantage of being able to process credit card payments.
Does PCI Apply to Your Site?
All eCommerce sites must comply with the PCI standards. You must submit their requirements as listed on their official website. There are 4 levels for merchants with level 1 as the highest and level 4 as the lowest.
- Level 1 – Merchants processing over 6 million Visa transactions a year
- Level 2 – Merchants processing from 1 million to 6 million Visa transactions a year
- Level 3 – Merchants processing from 20,000 to a million Visa transactions a year
- Level 4 – Merchants processing less than 20,000 Visa transactions a year
- Note: All of these are regardless of what acceptance channel used.
Complying with the PCI standards is quite complicated and difficult but it’s a must to any eCommerce sites to have. There are companies that also offer their services to make this process a lot less daunting.
The Standards Set by PCI that You Must Meet in Order to be PCI Compliant
There are 6 categories for PCI standards:
- Secure Network Maintenance – It is important to get a secure network and to maintain it. For eCommerce, the web server is the network that is vulnerable for attacks and data theft. It is important that hosting companies make sure that these networks are secure at all times to keep the cardholder data in safe hands.
- Cardholder Sata Protection – For eCommerce, cardholder data needs to be encrypted with at least the 128bit SSL certificate as the data is being sent over the internet. By encrypting the data, even when it is accessed illegally, they will still have difficulty in figuring out what the encryption says.
- Vulnerability Management Program – It’s important to maintain your computer hardware updated as well as the software and operating systems used. Most of all, regular anti-virus software updates and scans are also essential.
- Access Control Restriction – It is important to minimize the number of individuals who will be getting access to the cardholder data and each individual must be identified.
- Network Testing and Monitoring – By regularly testing and monitoring the networks storing the data will make sure that the network is safe and secure.
- Policy for Information Security – Information security policy is important for any company whether it’s for eCommerce or a physical business to have. Every individual must know about the policy regarding the cardholder data to avoid human errors and corruption.
For eCommerce, by being PCI compliant gives customers the peace of mind knowing that their credit card information are safe and will not be used for other purposes.
