Does your company process credit card and payment information?

Guaranteeing the security of transactions carried out using payment cards is a priority for all of us today. Therefore, entities enabling this type of activity decide to implement advanced solutions, thanks to which both our private data and funds in the bank account are safe. One of them is the PCI DSS certificate. What is it and why is it so important to us?

Read about what PCI DSS is.

Year after year, consumers are becoming more aware of how important it is to secure their sensitive data. This can be seen in the results of the “Lost in Transaction: Consumer payment trends 2022” study, which indicates that as many as 70% of the 11,000 surveyed individuals from 10 European countries do not want to share their financial data online. Meanwhile, 62% of respondents feel anxious when they are not asked for additional security information before making a payment.

The solution aimed at reducing consumer concerns is PCI DSS (Payment Card Industry Data Security Standard), which is the Security Standard in the Payment Card Industry. It is a set of requirements designed to ensure maximum protection of data collected on our payment cards. This standard was developed in 2006 by the PCI Security Standards Council, established by payment organizations such as Visa, MasterCard, American Express, Discover, and JCB. It contributes to the real minimization of the risk of data loss, identity theft, and other frauds.

Which organisations must comply with PCI DSS requirements?

Today, all companies dealing with payment card services are obliged to comply with PCI DSS standards, regardless of their size and the stage at which they handle cards. This means that such a certificate must be held by all:

• banks;
• FinTech sector companies;
• commercial and service points;
• payment service providers;
• e-commerce portals;
• insurance companies.

It is worth emphasising that entities that do not comply with the standards set out in PCI DSS must face serious consequences. They are threatened not only with financial penalties, but also with exclusion from card service participation, which consequently negatively affects the company’s image and its credibility.

Requirements necessary to obtain a PCI DSS certificate:

A company that is interested in obtaining a PCI DSS certificate is obliged to meet 12 requirements that allow for the protection of payment card data at every stage of their processing in the network. These requirements have been divided into 6 main control objectives:

• creation and maintenance of a secure network – companies are obliged to build and then maintain a properly configured network securing the data of payment card holders. It is also important that they do not use default passwords and manufacturer settings;
• protection of payment card holder data – companies are obliged to securely store payment card holder data, as well as encrypt data transmission when the user uses public networks;
• maintenance of a proper functioning payment management program – in this respect, it is important to regularly update antivirus programs, security systems and applications;
• implementation of strong access control measures – access to cardholder data should only be possible for entities with specific business needs, and each user must have their own, unique identifier;
• regular monitoring and testing of networks – it is crucial to track all access to network resources and cardholder data, as well as systematic testing of security processes;
• management of information security policy – this concerns the security of information of both employees and service providers.

Meeting such strict requirements is not easy. For this reason, we can be sure that those organisations that can boast of having a PCI DSS compliance certificate provide very high standards of payment data security at every stage of their processing.