Secure network
Install and maintain firewalls; don't use default passwords or settings.
PCI DSS · Payment security
PCI DSS: payment card security
Comply with the card industry standard, avoid liability and protect your customers' data.
Origin and purpose
A standard to stop card fraud
In response to rising payment card fraud, in 2006 Visa, Mastercard, American Express, JCB and Discover created the PCI Security Standards Council.
That led to PCI DSS (Payment Card Industry – Data Security Standard), which defines requirements for managing security, policies, procedures, network architecture and software design.
Its goal: reduce fraud and protect the processing, transmission and storage of cardholder data.
Who does it affect?
Any organization that accepts, transmits or stores cardholder data
Regardless of size or transaction volume.
Merchants and e-commerceSupermarketsTravel agenciesPayment gatewaysTransaction processorsISP/ASP providersCard manufacturersBanks and financial institutions
Requirements
Six goals, twelve requirements
Protected cardholder data
Protect stored data; encrypt its transmission across open or public networks.
Vulnerability management
Protect systems against malware; develop and maintain secure systems and applications.
Access control
Restrict access on a need-to-know basis; identify each user; restrict physical access.
Monitoring and testing
Log and monitor access; regularly test the security of systems and processes.
Security policy
Maintain an information security policy for all personnel.
Services we offer
From scans to specialized support
Quarterly scans
Vulnerability scans performed by a group company approved by the PCI SSC, with an encrypted report every quarter.
Ethical hacking
Penetration tests that simulate a real attacker, rank findings by severity and recommend how to mitigate them.
Training and support
Training and support for the team rolling out the security plan, supervised by specialized staff (QSA or PCIP).
Benefits
What you get with PCI DSS
Reduced liability
Protection against investigation and legal costs, and costs from misuse of card data.
Justified costs
Security investment backed by a compliance obligation.
Customer trust
Anyone paying by card knows their data is handled under a standard.
Integrated compliance
It aligns with other security and privacy regulations, and with ISO 27001.
FAQ
What clients ask us most
What is PCI DSS?
The payment card industry data security standard. It defines twelve requirements grouped into six goals to protect cardholder data.
Who must comply with PCI DSS?
Any organization that accepts, processes, transmits or stores payment card data, regardless of size.
Do you process, transmit or store cardholder data?
Tell us about your case and we'll map out your PCI DSS compliance path.