The Payment Card Industry Data Security Standard (PCI DSS) is a set of industry standards designed to protect payment card data. Intended to create an additional level of protection for consumers and reduce the risk of data breaches involving personal cardholder data, the standards are comprised of 12 broad requirements and collectively, more than 200 line item requirements. These requirements can be grouped into six key areas: building and maintaining a secure network, protecting cardholder data, maintaining a vulnerability management program, implementing strong access control measures, regularly monitoring and testing networks, and maintaining an information security policy.

Any organization that transmits, stores, or processes primary account numbers (PAN) is required to comply with the PCI DSS. This includes financial institutions, merchants, service providers, and anyone who accepts payment cards. Compliance is mandatory regardless of the size of the merchant or the number of card transactions they process each year. You may be required to complete PCI reporting documentation even if outsourcing your payment card processing to a third party.

By properly implementing the PCI DSS and achieving compliance, merchants can improve their overall security posture and avoid costly fines and data breaches. They can be better prepared to prevent and detect attacks against their information assets. PCI compliance can improve operational efficiency by ensuring policies are defined and procedures are documented. Controls developed for PCI can be rolled out across the organization to spread security benefits and maximize return on investment.

Although the PCI DSS requirements are developed and maintained by the PCI Security Standards Council (SSC), the standards are enforced by the five payment card brands: Visa, MasterCard, American Express, JCB International, and Discover. Each brand provides its own compliance guidelines, reporting and validation requirements, deadlines, and penalties for noncompliance. Please contact your merchant bank for specific validation requirements and deadlines.

Failure to comply with PCI requirements can lead to steep fines and penalties levied by card brands, revocation of credit card payment services, or suspension of accounts. Security oversights can leave merchants vulnerable to costly data breaches, lawsuits, remediation costs, and irreparable damage to reputation. Fines can range from $2,000 to more than $100,000 per month for violations. If cardholder data is compromised, merchants may also be subject to fraud losses and the cost of re-issuing cards.

No, PCI compliance alone won't protect corporate data and systems from all threats. PCI compliance should be viewed as the baseline, not the end goal. Annual validation means nothing without continual efforts to maintain that compliant state. Only by designing, implementing, and maintaining effective security controls can organizations gain security alongside compliance. A well-defined security program can help address new and emerging threats as well as innovations in technology.