PCI Compliance / Website Security

Payment Card Industry Security Standards Council (‘PCICo’) defines the standard for securing Personal Account Numbers (‘PAN’) and personally identifiable information (‘PII’), wherever it is located. Compliance is required of all entities storing, processing, or transmitting cardholder data. Acquiring Banks must comply with PCI and are responsible for ensuring the compliance of their merchants for all payment channels, including retail (brick-and-mortar), mail/telephone-order, and ecommerce.

Click here for Demo of the PCI ToolKit Wizard.

Business Merchant Account

Cardholder Data Security Requirements

PCI is a result of collaboration between VISA® andMasterCard®to create common industry security requirements.  Other card companies operating in the U.S. have also endorsed the Standard within their respective programs.

The PCI Requirements

1. Install and maintain a working firewall to protect data
2. Keep security patches up-to-date
3. Protect stored data
4. Encrypt data sent across public networks
5. Use and regularly update anti-virus software
6. Restrict access by "need to know"
7. Assign unique ID to each person with computer access
8. Don't use vendor-supplied defaults for passwords and security parameters
9. Track all access to data by unique ID
10. Regularly test security systems and processes
11. Implement and maintain an information security policy
12. Restrict physical access to data

How PCI Works:

Merchants are responsible for using service providers that are PCI-compliant.  VISA® orMasterCard®may impose a fine on non-compliant merchants and in severe cases bar the merchant from accepting VISA® orMasterCard®Credit Cards. 

Merchants receive protection from fines in the event of a data compromise when their merchant service provider is found to be PCI-compliant at the time of the security breach. Merchants are, however, subject to fines—up to $500,000 per incident—if they are not PCI compliant at the time of the breach.

PCI Groups Defined

Validation Actions