PCI DSS Compliance

Introduction

The Payment Card Industry Data Security Standard (PCI DSS) is required by all businesses that store, process or transmit cardholder data. Businesses who do not comply with this standard risk being fined or having their card processing capability withdrawn.

More importantly though, without these relatively basic information security controls in place, there is the very real potential for a security breach resulting in cardholder data loss and the potential financial penalties and impact to reputation that go with that.

Scope and Levels

The full PCI DSS extends to over 300 individual requirements however, depending on how many credit card records you are exposed to each year – and by which channels – not all of these may apply to your business.

If you are a merchant handling 6 million or more card transactions or records per year then you are categorised as Level 1 and are required to be formally assessed by a PCI Qualified Security Assessor (QSA) each year. Under this number and it will require the submission of an annual Self Assessment Questionnaire.

If you are a Service Provider providing services to merchants or other service providers that require you to be PCI DSS compliant, the levels are different. You will need a QSA to produce your Report of Compliance (ROC) once you are processing over 300,000 transactions per year. Under this and you can also self-assess.

The following table breaks down the PCI DSS levels for Merchants.

PCI DSS Levels for Service Providers