The card associations have implemented mandatory Payment Card Industry (PCI) Data Security Standards as a result of continuing fraud. These standards impact all merchants. Any merchant may be required to meet the minimum standards as set forth by the associations. Failure to fully comply with the requirements can result in fines and enhance compliance levels. The terms and conditions of your merchant agreement require you to fully comply with all card association regulations.
The following is more in-depth information from Visa.com. For additional information related to PCI, please visit the associations’ websites at https://sdp.mastercardintl.com or www.visa.com/cisp.
CISP compliance is required of all merchants and service providers that store, process, or transmit Visa cardholder data and applies to all payment channels, including retail (brick-and-mortar), mail/telephone order, and e-commerce. Compliance with CISP means compliance with the PCI Data Security Standard with the required program validation.
The Payment Card Industry (PCI) Data Security Standard offers a single approach to safeguarding sensitive data for all card brands. Other card companies operating in the U.S. have also endorsed the PCI Data Security Standard within their respective programs. Using the PCI Data Security Standard as its framework, CISP provides the tools and measurements needed to protect against cardholder data exposure and compromise. The PCI Data Security Standard consists of twelve basic requirements, categorized as follows:
|PCI Data Security Standard|
|Build and Maintain a Secure Network||Install and maintain a firewall configuration to protect data
Do not use vendor-supplied defaults for system passwords and other security parameters
|Protect Cardholder Data||Protect stored data
Encrypt transmission of cardholder data and sensitive information across public networks
|Maintain a Vulnerability Management Program||Use and regularly update anti-virus software
Develop and maintain secure systems and applications
|Implement Strong Access Control Measures||Restrict access to data by business need-to-know
Assign a unique ID to each person with computer access
Restrict physical access to cardholder data
|Regularly Monitor and Test Networks||Track and monitor all access to network resources and cardholder data
Regularly test security systems and processes
|Maintain an Information Security Policy||Maintain a policy that addresses information security|