How do I get PCI for free?

In the late 20th century, Visa suffered a loss of $750 million in credit card fraud. From 1988 to 1998, billions of dollars worth of transactions were processed every year and since internet commerce was only getting bigger, credit card transactions were becoming more frequent. This made them even more vulnerable to credit card fraud. In an attempt to forestall, 1999  marked as the year Visa developed the Cardholder Information Security Program (CISP). This is the first-ever set of standards put in place for businesses accepting payments through credit cards. However, attackers continued to exploit vulnerable machines and card frauds became more rampant. The leaders in the credit card industry then got together to develop a common set of security standards for merchants to comply with when accepting card payments. Payment Card Industry Data Security Standard 1.0 made its debut in the market in December 2004. Since its initiation, these standards have been evolving continuously to accommodate the needs of the agile market. 

Today, as businesses lead with their best foot forward into the e-commerce world, the widespread concerns about phishing attempts and cyberattacks bring them back to square one. However, preventing attacks from malicious hackers requires pursuing PCI compliance. 

Talk to us to be PCI compliant for free!

PCI DSS – An Overview

Well, what is PCI DSS? Payment Card Industry Data Security Standard or PCI DSS compliance is a framework of set standards businesses must oblige with to process secure payments. To iterate, businesses that store customer’s card data are required to prove compliance for their card issuer. “Hackers are looking for this type of data because of its use in counterfeiting payment cards, and that is why Visa prohibits its storage,” affirmed Eduardo Perez, head of global data security for Visa Inc. This is a system through which network safety is determined. 

Think of a security system for your house. Similarly, PCI DSS compliance ensures that the said business processing card payments have established a framework to protect its system and infrastructure. This is representative of businesses take long strides in the direction of data security for their customers and protecting the system from breaches and cyberattacks. 

Hence, all merchants that store, accept or transfer card data are required to comply with the PCI DSS standard. Most processors make it necessary for businesses to annually validate how secure the environment is. Based on the number of card payments processed by your company, you will need a Self-Assessment Questionnaire or an onsite audit; held independently. 

Goals and Resources

PCI DSS helps build and maintain a secure network. It is an effective system woven with complexities. These standards serve 6 main goals for the merchant: 

• Developing and maintaining a secure system
• Protecting cardholder data by encrypting transmission
• Establish a vulnerability management program 
• Implement durable access control measures by authenticating access to systems 
• Monitoring and testing networks regularly 
• Put in place an information security policy for all

There is a further breakdown of these six overarching goals. There are over 200 sub-requirements complementing each of these goals. And as it continues to evolve, it only becomes more extensive. The current version was introduced in May of 2018. PCI DSS 3.2.1. Added five more sub-requirements relating to new appendices on the migration of Secure Socket Layer and multi-factor authentication. 

Additionally, merchants have access to several resources if they are PCI DSS compliant: 

• Self-Assessment Questionnaires: Helps validate PCI compliance
• PIN Transaction Security (PTS) requirements: for device manufacturers and vendors and 
• List of approved PIN transaction devices
• Payment Application Data Security Standard (PA-DSS) 
• List of approved Payment Application

PCI Compliance – Law or Not? 

“Require”, “necessary”, “must”, are all words that have come up too often in this article. So, is PCI compliance required by the law? The simple answer: No, it is a security standard. To elaborate, compliance with PCI DSS is made mandatory by card brands and banks that process the payments. This is essential to understand because, in case of a data breach that can be traced back to the poor implementation of the standards, the business is sanctioned by the payment processing company. 

Merchants are then needed to undergo a comprehensive assessment to validate an improvement in their security. They have to pay for these assessments and are also subjected to hefty fines. These fines can range from $5,000 to $10,000 per month until the company demonstrates compliance. In the case of large-scale companies, they must undergo third-party assessments even when there are no breaches. 

It is important to note that fines are not regulated by the government. Meaning that when your pay these fines for a data breach as a merchant, you are not paying for infracting government regulation; these fines are a part of the contracts maintained between payment processors, merchants, and card companies. Usually, in this system, the card companies fine the payment processors, merchants are likewise fined by payment and many times, and this is not based on standards of evidence one expects in a legislative system. However, some major disputes are addressed through the civil courts. 

Cost-Effective Approach to PCI DSS Compliance

Back in 2009, the card brands that introduced PCI DSS ( Visa, MasterCard, Discover, JCB International and American Express), made it mandatory for European retailers to comply with these security standards. A fraud analyst at Gartner Inc., Avivah Litan, called this “a huge announcement” since these requirements were made compulsory for US-based retailers only. Following this remark, she anticipates that European merchants would need to spend around $2 billion to $4 billion to adequately execute these requirements. These took effect in September 2009. 

It is a huge investment but it is a worthwhile pursuit for businesses of all sizes. If you are handling online payments, wishing to protect your reputation and consumer data, PCI compliance is what you should be opting for. There are various ways to go about it. Firstly, you can do it yourself. You can designate a team that designs, tests, and conducts regular assessments. You pay the PCI compliance fees and see to it that the transactions are processed in a secure environment. This way, you incur costs for each step involved. Moreover, in case of a data breach or a cyberattack, the business will retain the liability of keeping the systems secure. Finally, there will be a cost for the level of certification you apply for, this is contingent on the number of transactions you process annually. 

Or, you could work with a reputed security partner. This, in turn, shifts the responsibility of data breaches from your business to the security partner. Thus, it minimizes the risk of working with sensitive data. You bear a fee and the partner takes care of PCI DSS for you. 

But what if you did not need to spend a penny to become PCI compliant. Your business can do so by switching to a merchant service that does it for free. With us, PCI compliance can be effortless. Omnipay helps businesses become compliant in a hassle-free manner. We will guide you on the best practices to ensure you process payments securely, protecting your customer’s valuable data and maintaining your business reputation. To top it all, unlike most payment processing companies in the market today, we do not charge PCI compliance!

Talk to us to be PCI compliant for free!