It doesn’t matter what type of business you run, at a certain point you are going to take payments from customers. Since credit and debt cards are so convenient and beneficial, your customers will prefer to pay with one of these two options. When processing these credit or debt card payments, you have the task of ensuring your customers’ financial data remains secure.
Identity thieves and data hacks continue to break news which makes online security even more important. As a business owner, you must abide by the Payment Card Industry’s (PCI) Data Security Standards (DSS). These rules not only protect your customers, but they protect your business too. For instance, the rules reduces the likelihood that a fraudulent transaction will be made. This is what you need to know about your business and PCI compliance.
Know PCI Compliance Levels
Your PCI compliance requirements do vary according to your business size and scope. Compliance levels are broken into four parts:
Level 1 – If your business processes more than $6 million debt and credit card transactions each year, you are in this compliance category. You are required to complete network scans each quarter. If you are in this category, an independent security assessor must evaluate your compliance validation each year.
Level 2 – If your company processes card transactions each year ranging from $1 to $6 million credit and debt card transactions, this is your category. Every year you must to complete a PCI self-assessment survey. Every quarter, you must to participate in network scans to determine if your compliance is valid.
Level 3 – If your business processes credit and debt card transactions ranging from $20,000 to $1 million each year, you are in this category. You are required to a business self-assessment every year. You are also required to complete quarterly network scans to validate your compliance.
Level 4 – For this level, your business must process less than $20,000 annually. Your business is not required to complete compliance validation. However, it is strongly recommended to complete the validation. Your business must still comply with all PCI requirements regardless of the validation.
If you are in the last category, level 4, you are not alone. Majority of small businesses are in Level 4. It is less strict, but does have the most requirements to complete to remain in PCI compliance. They are separated into six categories:
- Create and Maintain Your Secure Network
Processing debit and credit card transactions requires having firewalls to protect financial date. Firewalls must be regularly updated and maintained to prevent the latest online security threats. Never use default passwords for network access and require complex passwords.
- Protect Your Customers’ Data
All credit card data must be securely stored, encrypted to prevent theft and regularly updated.
- Protect Against Data Hacks
Create and maintain vulnerability business management program. The program should be equipped with anti-virus software to prevent breaches. Update the software frequently.
- Have Financial Access Control Measures
Restrict access to customer financial data only those who truly need that access, Each user must have a unique ID to monitor and a prevent data breach.
- Regularly Test and Monitor Your Networks
You are required to test and monitor access to customer data to prevent internal threats.
- Keep Security Policy Information Regularly Updated
Your business must have a policy outlining describing your data and network security. Your employees must know and understand your policy and abide its standards.
PCI compliance is complex and you shouldn’t try to meet the standards alone. PCI compliance software such as ZenGRC by Reciprocity is a great way to manage compliance correctly.
Ken is an enterprise software startup veteran, who has always been fascinated about what drives workers to work and how to make work more engaging. Ken founded Reciprocity to pursue just that. He has propelled Reciprocity’s success with this mission-based goal of engaging employees with the governance, risk, and compliance goals of their company in order to create more socially minded corporate citizens. Ken earned his BS in Computer Science and Electrical Engineering from MIT.