The Basics of PCI Compliance and Validation Regulations

 

The payment card industry compliance and validation regulations apply to financial institutions, Internet vendors and retail merchants. The rules spell out what security measures must be taken to protect the private information of employers and employees during any transaction occurring with the use of a paycard. They also require certain auditing procedures. The Payment Card Industry Data Security Standard is used by all card brands to assure the security of the data gathered while an employee is making a transaction at a bank or participating vendor.

There are six categories of PCI compliance security standards.

Build and Maintain a Secure Network

Requirement 1: Install and maintain a firewall configuration to protect cardholder data
Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data

Requirement 3: Protect stored cardholder data
Requirement 4: Encrypt transmission of cardholder data across open, public networks

Maintain a Vulnerability Management Program

Requirement 5: Use and regularly update anti-virus software
Requirement 6: Develop and maintain secure systems and applications

Implement Strong Access Control Measures

Requirement 7: Restrict access to cardholder data by business need-to-know
Requirement 8: Assign a unique ID to each person with computer access
Requirement 9: Restrict physical access to cardholder data

Regularly Monitor and Test Networks

Requirement 10: Track and monitor all access to network resources and cardholder data
Requirement 11: Regularly test security systems and processes

Maintain an Information Security Policy

Requirement 12: Maintain a policy that addresses information security

Additionally, there are four merchant categories:

1. Merchants with more than 6,000,000 transactions per year. Other merchants in Level 1 will be merchants whose security has been violated and data compromised and merchants which another credit card company have classified as Level 1.
   
   
2. Merchants with 150,000 to 6,000,000 transactions per year.
   
   
3. Merchants with 20,000 to 150,000 transactions per year.
   
   
4. Merchants with less than 20,000 transactions per year

PCI Compliance Validation

Credit card companies validate that vendors are abiding by the PCI Compliance regulations. The volume of transactions and the risk determined by the credit card company determines the validation rating for the merchants and institutions accepting credit/debit and paycards. Along with requiring participating businesses to complete a self-assessment questionnaire, MasterCard and Visa perform the following actions to validate a participating business' security:

1. An on-site visit and
   
   
2. A network scan performed by an authorized PCI Compliance scanning vendor.