Do you know what PCI DSS is and what it's for?

Before we start, let's look at the initials. What is PCI DSS? It stands for Payment Card Industry Data Security Standard. So, now you know what the initials stand for. But what does it mean? Read our blog to find out.

What is the Payment Card Industry Data Security Standard?

This long term refers to a set of mandatory security standards for all companies, designed to protect credit card data and this way comply with the Payment Card Industry Data Security Standard (PCI DSS).

What is the objective of the PCI DSS?

This control system was launched in 2006 with the aim of improving management and security in online payment processes. The biggest credit card providers (VISA, American Express, MasterCard, JBC and Discover) agreed to establish a council through which they established a set of security controls to ensure that merchants meet the required level of security when they store, process and transmit cardholder data.

Which security controls must be met with the PCI DSS?

The PCI DSS is composed of 12 requirements. The 12 requirements of the PCI DSS are:

1. Install and maintain a firewall configuration to protect cardholder data.
2. Do not use vendor-supplied defaults for system passwords and other security parameters. This makes it more difficult for hackers to exploit the systems.
3. Protect stored cardholder data.
4. When data is stored, it must also be encrypted to ensure cardholder data protection and any confidential data that may have been transmitted on open public networks.
5. Protect all systems against malware and regularly update antivirus software or programs.
6. Develop and maintain secure systems and applications.
7. Restrict access to cardholder data by business need to know.
8. Identify and authenticate access to system components.
9. Restrict physical access to cardholder data.
10. Track and monitor all access to network resources and cardholder data.
11. Regularly test security systems and processes.
12. Maintain a policy that addresses information security in all areas.

How can I know if I am compliant with the PCI DSS?

A Self-Assessment Questionnaire (SAQ) is available, with which you can verify if your company is compliant with the PCI standard and therefore is approved for processing sensitive data.

What happens if I am not compliant with the Payment Card Industry Data Security Standard?

If the results of the aforementioned questionnaire show you are not compliant, it is strongly advisable for you to become compliant as, if the card data you hold is accessed and/or used fraudulently, financial penalties will be imposed, and you will face legal problems and impact your brand reputation.

Above all, remember that network security is one of the most important factors for consumers. It is, in fact, unthinkable to suggest making an online purchase through an unsecured system.

As well as ensuring security, it is also important to reach as many consumers as possible. So, keep in mind that your website should ideally be translated into as many languages as possible. If this option isn't possible, at least make sure it is translated into English, which is the universal language.