Outlined by the Safety Normal Council, the Cost Card Business Information Safety Normal (PCI DSS)is a set of tips that require companies that retailer, course of, and/or transmit bank card funds and cardholder knowledge to adjust to technical and operational finest practices.
Merely put, for those who settle for or course of bank card funds—whatever the greenback quantity collected or whether or not a Visa, Mastercard, American Categorical, Uncover, pay as you go card, or debit card is used—PCI DSS applies to you.
Changing into PCI compliant not solely tells your clients that you're defending them in opposition to knowledge breaches, however it additionally protects your organization from cybersecurity assaults.
However simply how are you aware if your online business is PCI compliant?
Enter PCI Self-Evaluation Questionnaires (SAQs), in any other case generally known as PCI compliance questionnaires.
For those who’re new to PCI SAQs and the right way to use them to judge your ranges of compliance, this information is right here to assist.
Beneath, we are going to break down:
- What PCI SAQs are.
- How they correlate with totally different ranges of service provider compliance.
- The significance of sustaining PCI compliance to guard your online business and your clients.
What are PCI SAQs?
PCI SAQs are complete self-validation instruments that consider your cardholder knowledge safety, in addition to present you and your clients with peace of thoughts. These PCI compliance questionnaires embrace a sequence of yes-or-no questions for relevant PCI DSS necessities.
It’s essential to notice that there are totally different SAQs to fulfill requirements set inside totally different service provider environments.
PCI SAQs and Service provider Compliance Ranges
- Service provider Stage 1: Over 6 million transactions a calendar 12 months.
- Service provider Stage 2:1 to six million transactions a calendar 12 months.
- Service provider Stage 3:20,000 to 1 million transactions a calendar 12 months.
- Service provider Stage 4: Lower than 20,000 transactions a calendar 12 months.
Service provider Stage 1 Necessities
For those who fall into the Stage 1 class, you're a main service provider or service supplier that collects bank card info and processes over 6 million transactions every year—which suggests you might be topic to the best PCI compliance requirements.
For Stage 1 retailers, you’ll have to finish:
- An annual threat evaluation utilizing the suitable SAQ.
- An Attestation of Compliance (AOC), which certifies that you're eligible to carry out the SAQ.
- An annual audit accomplished by a certified PCI auditor.
- Quarterly scans in your community and infrastructure by an accepted third-party vendor.
You may additionally qualify as a Stage 1 service provider for those who course of greater than 2.5 million American Categorical transactions, or in case you have had a cyberattack or knowledge breach that resulted in compromised bank card knowledge. It’s essential to notice that you just solely want one knowledge breach and one piece of bank card knowledge stolen to qualify into this class.
Service provider Stage 2 Necessities
You're a large-scale service provider or service supplier who collects bank card info and processes between 1 million to six million transactions every year. You may also qualify as a Stage 2 service provider for those who course of between 50,000 and a couple of.5 million American Categorical transactions.
For those who fall into the Stage 2 class, you need to full:
- An annual threat evaluation utilizing the suitable SAQ.
- Quarterly scans of your community by a third-party vendor, though not all the time required in some instances.
Service provider Stage 3 Necessities
You're a medium to large-scale service provider or service supplier who collects bank card info and processes between 20,000 and 1 million VISA and Mastercard eCommerce transactions every year. You may also qualify as a Stage 3 service provider for those who course of fewer than 50,000 American Categorical transactions every year.
For those who fall into the Stage 3 class, you need to full:
- An annual threat evaluation utilizing the suitable SAQ.
- Quarterly scans of your community by a third-party vendor, though not all the time required in some instances.
Service provider Stage 4 Necessities
You're a small-scale service provider or service supplier who collects bank card info and processes lower than 20,000 eCommerce transactions every year and lower than 1 million complete Visa and MasterCard transactions. American Categorical transactions are usually not relevant for Stage 4 retailers.
For those who fall into the Stage 4 class, you need to full:
- An annual threat evaluation utilizing the suitable SAQ.
- Quarterly scans of your community by a third-party vendor, though not all the time required in some instances.
12 Safety Requirements for PCI Compliance at All Service provider Ranges
Diagram displaying the journey of a card cost transaction from the client to a service provider checking account.
There are 12 safety requirements per the PCI DSS framework that each one service provider ranges will need to have throughout their inside and exterior networks, together with:
- Putting in and sustaining a firewall configuration to guard cardholder knowledge.
- Not utilizing vendor-supplied defaults on your system passwords and different safety parameters.
- Defending saved cardholder knowledge.
- Encrypting transmission of cardholder knowledge throughout open and public networks.
- Utilizing and commonly updating your antivirus software program.
- Growing and sustaining safe techniques and purposes.
- Proscribing entry to cardholder knowledge by enterprise need-to-know foundation.
- Assigning a novel ID to every individual with laptop entry.
- Proscribing bodily entry to bank card knowledge.
- Monitoring and monitoring all entry to community sources and cardholder knowledge.
- Often testing safety techniques and processes.
- Sustaining a safety coverage that addresses info safety for employers and contractors.
One other safety commonplace you can observe is to discover a processor or gateway that can home your bank card knowledge in a token.
Tokenization helps in opposition to cyberattacks by changing the client’s main account quantity (PAN) with a string of randomly-generated numbers (generally known as a token). Tokens can then be handed via the Web or the wi-fi networks wanted to course of a cost with out exposing PANs.
When looking for a tokenization processor, make sure you select a PCI-compliant group.
Overview of SAQ Varieties
There are eight several types of SAQs that it's essential to choose from primarily based in your PCI compliance degree and your service provider community.
| SAQ | # of Questions | Description | Vulnerability Scan? | Penetration Scan? |
|---|---|---|---|---|
| A | 22 | eCommerce web site (third occasion): • Totally outsourced card acceptance and processing. • Service provider web site supplies an iFrame or URL that redirects a client to a third-party cost processor. • Service provider can't influence the safety of the cost transaction. |
N | N |
| A-EP | 191 | eCommerce web site (direct put up): • Service provider web site accepts cost utilizing direct put up or clear redirect service. |
Y | Y |
| B | 41 | Processes playing cards through: • Analog cellphone, fax, or stand-alone terminal. • Mobile phone (voice), or stand-alone terminal. • Knuckle buster/imprint machine. |
N | N |
| B-IP | 82 | Processes playing cards through: • Web-based stand-alone terminal remoted from different units on the community. |
Y | N |
| C-VT | 79 | Processes playing cards: • One by one through keyboard right into a digital terminal. • On an remoted community at one location. • No swipe machine. |
N | N |
| C | 160 | Cost software techniques related to the Web: • Digital terminal (Not C-VT eligible). • IP terminal (Not B-IP eligible). • Cellular machine (smartphone/pill) with a card processing software or swipe machine. • View or deal with cardholder knowledge through the Web. • POS with tokenization. |
Y | N |
| D | 329 | eCommerce web site: • Service provider web site accepts cost and doesn't use a direct put up or clear redirect service. Digital storage of card knowledge: |
Y | Y |
| P2PE | 33 | Level-to-point encryption • Validated PCI P2PE {hardware} cost terminal answer solely. • Service provider specifies they qualify for the P2PE questionnaire. |
N | N |
The Significance of Sustaining PCI Compliance
Sustaining PCI compliance is essential for retailers in any respect ranges, as it should show you how to shield your online business in opposition to cyberattacks, safeguard delicate buyer knowledge, and keep away from fines that could possibly be between $5,000 and $100,000 per thirty days. To make sure you are assembly compliance requirements, you may carry out vulnerability and penetration scans primarily based on which kind of SAQ you full.
Vulnerability Scans
A vulnerability scan permits you to scan your system community and purposes to search for weaknesses in your working system, companies, and units that could possibly be focused by hackers. It’s useful to carry out vulnerability scans as soon as 1 / 4, and you need to submit a passing scan to your processor for every card sort you settle for.
Penetration Scans
Penetration scans are carried out yearly on prime of your quarterly vulnerability scans. These scans are used to use any vulnerabilities in your code or community that will pave the way in which for hackers to achieve entry to delicate info. Penetration scans make the most of actual customers who try to dig into your system to seek out any weaknesses. Whereas these assessments could be costly, they're essential to making sure your community stays safe.
Be aware: You possibly can carry out penetration scans internally, however these assessments have to be performed by a certified person who's unbiased of the system they're checking.
Liquid Internet’s Safety Workforce performs these penetration assessments for Liquid Internet clients.