Do You Know What the Payment Card Industry Data Security Standard Is and Why It’s Important?

Do You Know What the Payment Card Industry Data Security Standard Is and Why It’s Important?

‍

The Payment Card Industry Data Security Standard (PCI DSS) defines controls for protecting cardholder data and sensitive authentication information during processing, storage, and transmission.

It’s important to note that before the first version of PCI DSS was released, each payment card brand had its own security program to protect cardholder data. According to Cristián Cáceres, Risk Manager at Paytech One:

• American Express: Data Security Operating Policy (DSOP)
• Discover: Discover Information Security Compliance (DISC)
• JCB International: Data Security Program (DSP)
• MasterCard: Site Data Protection (SDP)
• Visa USA: Cardholder Information Security Program (CISP)
• Visa International: Account Information Security Program (AIS)

Each of these programs set specific security controls to be implemented and defined which entities had to comply with them. However, if a company stored, processed, or transmitted card data from different brands, it had to comply with each brand’s security program. This often led to duplication, inconsistencies, and overlapping controls, explains Cárceres.

‍

Essential for Operations

According to Cáceres, PCI compliance is essential for operations. Its importance lies in the fact that it:
"creates a secure environment for handling sensitive data and serves as an incentive that positions the company as professional, responsible, serious, and trustworthy."

The PCI Security Standards Council’s mission is to improve the security of global payment data by developing standards and support services that drive education, awareness, and effective implementation by stakeholders.

‍

Mandatory Compliance

Although the specific requirements of PCI DSS vary depending on the type of entity, compliance is mandatory.

PCI DSS lays out the security foundation for protecting payment card transactions. Failure to comply can result in:

‍

1. Restrictions on processing transactions, imposed by card brands, acquiring banks, or payment gateways for non-compliant entities.
2. If a security breach occurs, the non-compliant entity is fully responsible for the following costs:
   • Legal claims and settlements;
   • Fraud from unauthorized transactions;
   • Replacement of compromised cards;
   • Fines from card networks, based on the number of records affected;
   • Legal penalties for personal data breaches;
   • Forensic investigation fees, handled by a certified specialist;
   • Costs of implementing PCI DSS controls after the incident;
   • Loss of reputation and public trust.