The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to ensure that ALL companies that process, store or transmit credit card information maintain a secure environment.  Essentially any merchant that has a Merchant ID (MID).
The Payment Card Industry Security Standards Council (PCI SSC) was launched on September 7, 2006 to manage the ongoing evolution of the Payment Card Industry (PCI) security standards with focus on improving payment account security throughout the transaction process.  The PCI DSS is administered and managed by the PCI SSC (www.pcisecuritystandards.org), an independent body that was created by the major payment card brands (Visa, MasterCard, American Express, Discover and JCB.).
It is important to note, the payment brands and acquirers are responsible for enforcing compliance, not the PCI council.

A copy of the PCI DSS is available here.

You should worry about business fallout.

More than 340 million computer records containing sensitive personal information have been involved in security breaches in the U.S. since 2005.1 Now criminals are shifting sights to small merchants because many have lax security for cardholder data. More than 80% of attacks target small merchants. If you are at fault for a security breach, business fallout can be severe:

•Fines and penalties
•Termination of ability to accept payment cards
•Lost confidence, so customers go to other merchants
•Lost sales
•Cost of reissuing new payment cards
•Legal costs, settlements and judgments
•Fraud losses
•Higher subsequent costs of compliance
•Going out of business

What data thieves are after

The object of desire is cardholder data. By obtaining the Primary Account Number (PAN) and sensitive authentication data, a thief can impersonate the cardholder, use the card, and steal the cardholder’s identity.

Sensitive cardholder data can be stolen from many places:
•Compromised card reader
•Paper stored in a filing cabinet
•Data in a payment system database
•Hidden camera recording entry of authentication data
•Secret tap into your store’s wireless or wired network

Defining “sensitive cardholder data”

Everything at the end of a red arrow is sensitive cardholder data. Anything on the back side and CID must never be stored. Everything else you store must be for a good business reason, and that data must be protected. PCI DSS explains how.

Small merchants are prime targets for data thieves. It’s your job to protect cardholder data at the point-of-sale.

If cardholder data is stolen – and it’s your fault – you could incur fines, penalties, even termination of the right to accept payment cards!

Let Host 99 help you become PCI Compliant and stay secured from hackers. Contact Us for more details.

Protecting cardholder data is good for your business

PCI security prevents stolen customer data, and:

• Prevents lawsuits
• Can save you money
• Helps you to stay in business

You are responsible for preventing theft of cardholder data

Follow these steps:

• Don’t store ANY sensitive cardholder data!
• Secure card readers, point-of-sale, and payment systems
• Use basic security techniques

Learn how

Details are in the PCI DSS.
It’s a strong, systematic way to secure cardholder data.

Getting Started with PCI Data Security Standard Compliance

PCI Security Standards are technical and operational requirements set by the PCI Security Standards Council (PCI SSC) to protect cardholder data. The Council is responsible for managing the security standards, while compliance with the PCI Security Standards is enforced by the payment card brands. The standards apply to all organizations that store, process or transmit cardholder data – with guidance for software developers and manufacturers of applications and devices used in those transactions.

If you are a merchant that accepts payment cards, you are required to be compliant with the PCI Data Security Standard. You can find out your exact compliance requirements only from your payment brand or acquirer. However, before you take action, you may want to obtain background information and a general understanding of what you will need to do from the information and links here.

The PCI DSS follows common-sense steps that mirror security best practices. There are three steps for adhering to the PCI DSS – which is not a single event, but a continuous, ongoing process. First, Assess — identify cardholder data, take an inventory of your IT assets and business processes for payment card processing, and analyze them for vulnerabilities that could expose cardholder data. Second, Remediate — fix vulnerabilities and do not store cardholder data unless you need it. Third, Report — compile and submit required remediation validation records (if applicable), and submit compliance reports to the acquiring bank and card brands you do business with.

For more information, download our Getting Started Guide and/or our Quick Reference Guide.

To learn what your specific compliance requirements are, check with your card brand compliance program:
• American Express: www.americanexpress.com/datasecurity
• Discover Financial Services: http://www.discovernetwork.com/fraudsecurity/disc.html
• JCB International: http://www.jcb-global.com/english/pci/index.html
• MasterCard Worldwide: http://www.mastercard.com/sdp
• Visa Inc: http://www.visa.com/cisp
• Visa Europe: http://www.visaeurope.com/ais

On Jan. 1, 2011, the latest version of the PCI DSS 2.0 went into effect. The revisions, which modify the Self-Assessment Questionnaires (SAQs), call for discontinuance of the existing PCI DSS version and SAQ forms by Dec. 31, 2011.

The PCI DSS 2.0 is another opportunity for you to engage merchants in active PCI education, provide valuable security information that strengthens the relationship and increase compliance rates throughout the portfolio. Use this information and leverage your PCI compliance solutions provider to build a strong and consistent communication and compliance plan.