Pci Compliance Builds Information Security
Posted on May 3, 2008 - Filed Under Business
The PCI DSS (Payment Card Industry Data Security Standard) is a set of 12 requirements that any merchant who stores, processes, or transmits sensitive information must conform to. This PCI compliance was designed to increase the level of information security and, as such, the consumer confidence in making those kinds of transactions.
Information security is a critical component of any business environment. Consumers are becoming more and more aware of the value of their own personal information, and they are, therefore, becoming more and more protective of it. Somehow a merchant must be able to prove that they are secure and properly positioned to protect that data while they have it.
For some consumers, a simple graphic is enough. Something claiming that someone has certified them as secure. For others, that’s not enough to convince them that there is a sufficient level of information security. So how are merchants supposed to convince these consumers that their data would be safe?
Then what are their option? They could list all the individual requirements of the various credit card companies and how their business practices conform to them. Of course, the average consumer probably wouldn’t take the time to delve into the technical jargon - and probably just assume that all the “fine print” was just a diversionary tactic.
Recognizing this problem, the Payment Card Industry instituted the PCI DSS so that there would be a standard by which all of those merchants can be measured, and, because the five major credit card companies were behind it, consumers could know that a relevant organization was judging the security measures being used.
PCI compliance, then, is one of the other critical components of any business environment. It is not, however, a particularly easy thing to accomplish. Not surprising, really, given the nature of the data it is supposed to protect.
So why go through with it? Well, other than the fact that it is a requirement, there’s the obvious drawbacks of not reaching PCI compliance (the likely security breaches), and the stiff fines and penalties if you do get breached (including the possible loss of the ability to accept payment cards at all). More than the immediate financial losses, though, is the inevitable loss of your reputation. Once your apparent lack of information security becomes known to the public, your future and long-term success will be thrown into question. Many companies can fight their way through monetary problems, but a bad reputation can follow them for years.
Some of the requirements for PCI compliance are common sense things, while others are more specified and often overlooked by many merchants. They range from installing and maintaining firewalls and virus protection to maintaining a policy that addressees information security throughout the company.
Some things, however, can have a tendency to slip. The third requirement states simply that you must “protect cardholder data.” Seems obvious, but where this can start to slide is when, over time, information security begins to get a little loose and the data finds itself on many different systems - rather than centralized where it can be easily defended - or passwords fail to get changed, and testing procedures are forgotten.
PCI compliance was designed to help merchants avoid this kind of information security entropy. Part of PCI compliance includes regular testing, assessments, and validation. Assessments can be performed by specially qualified assessors, or, if your company is small enough, you may be able to do the simpler Self-Assessment Questionnaire (PCI SAQ). If these are done properly, a company can continue to deliver a secure environment in which a consumer can confidently conduct transactions.
PCI compliance, when fully achieved and properly maintained, is crucial in developing strong information security. Information security is, in turn, crucial in developing customer relationships that will ensure long term success.
Andy Eliason is a writer at Main10, Inc. If you’d like to learn more about PCI compliance or how to increase your information security, contact Braintree Payment Solutions today.
Tags: consumer confidence, information security, Payment Card Industry, PCI compliance, PCI DSS, PCI SAQ
Related Posts
- Pci Compliance For Greater Online Success
- The Pci Dss - Implementing Strong Access Control Measures
- You Wont Know Unless You Try - Diy Home Security Systems
- 7 Questions To Ask Before Installing A Home Security Camera
- Top 5 Reasons For Home Security
Comments
Leave a Reply
