PCI Compliance

The card associations have implemented mandatory Payment Card Industry (PCI) Data Security Standards as a result of continuing fraud. These standards impact all merchants. Any merchant may be required to meet the minimum standards as set forth by the associations. Failure to fully comply with the requirements can result in fines and enhance compliance levels. The terms and conditions of your merchant agreement require you to fully comply with all card association regulations.

The following is more in-depth information from Visa.com. For additional information related to PCI, please visit the associations’ websites at https://sdp.mastercardintl.com or www.visa.com/cisp.

CISP Compliance

CISP compliance is required of all merchants and service providers that store, process, or transmit Visa cardholder data and applies to all payment channels, including retail (brick-and-mortar), mail/telephone order, and e-commerce. Compliance with CISP means compliance with the PCI Data Security Standard with the required program validation.

The Payment Card Industry (PCI) Data Security Standard offers a single approach to safeguarding sensitive data for all card brands. Other card companies operating in the U.S. have also endorsed the PCI Data Security Standard within their respective programs. Using the PCI Data Security Standard as its framework, CISP provides the tools and measurements needed to protect against cardholder data exposure and compromise. The PCI Data Security Standard consists of twelve basic requirements, categorized as follows:

PCI Data Security Standard
Build and Maintain a Secure Network Install and maintain a firewall configuration to protect data

Do not use vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data Protect stored data

Encrypt transmission of cardholder data and sensitive information across public networks

Maintain a Vulnerability Management Program Use and regularly update anti-virus software

Develop and maintain secure systems and applications

Implement Strong Access Control Measures Restrict access to data by business need-to-know

Assign a unique ID to each person with computer access

Restrict physical access to cardholder data

Regularly Monitor and Test Networks Track and monitor all access to network resources and cardholder data

Regularly test security systems and processes

Maintain an Information Security Policy Maintain a policy that addresses information security