Sign Colorado Banking Executive Summary Template Secure

Pci dss initial

what is the PCI DSS the payment card industry data security standard or PCI DSS was developed to encourage and enhance cardholder data security and to facilitate the broad adoption of consistent data security measures globally it applies to all merchants and service providers the process transmit or store cardholder data if your organization handles card payments it must comply or risk suffering financial penalties or even the withdrawal of the facility to accept card payments the PCI DSS was launched in 2004 and is the result of collaboration between the major credit card brands American Express Discover JCB MasterCard and Visa do I need to comply with the PCI DSS all organizations that accept credit and debit cards all that store process and/or transmit cardholder data need to comply with the standard merchants and service providers compliance requirements differ depending on a number of factors including the size of the organization and the volume of transactions it undertakes the criteria that a merchant or service provider have to meet as set by the individual payment brands each of which has its own compliance program what the penalties for non-compliance the pci-dss is a standard not of law it's enforced through contracts between merchants acquiring banks and payment brands each payment brand can fine acquiring banks for PCI DSS compliance violations and acquiring banks can withdraw the ability to accept card payments from non-compliant merchants it's also worth remembering that a PCI DSS breach is always a gbbr breach as Cardinal the data is classified as personal data under the regulation so as well as any enforcement action from your acquiring bank your organization could face administrative fines of up to 20 million euros currently nearly 18 million pounds or 4 percent of annual global turnover whichever is greater under the GDP are how to become PCI DSS compliant the PCI DSS specifies 12 requirements that are organized into six controlled objectives one build and maintain a secure Network install and maintain a firewall configuration to protect cardholder data do not use vendor supplied defaults for system passwords and other security parameters to protect cardholder data protect stored cardholder data encrypt Ran's mission of cardholder data across open public networks 3 maintain a vulnerability management program use and regularly update antivirus software or programs develop and maintain secure systems and applications for implement strong access control measures restrict access to cardholder data by business need-to-know assign a unique ID to each person with computer access restrict physical access to cardholder data 5 regularly monitor and test networks track and monitor all access to network resources and cardholder data regularly test security systems and processes six maintain an information security policy maintain a policy that addresses information security for employees and contractors compliance with the standard is notoriously complicated and many organizations fail to maintain their compliance Verizon's 2018 failing security report found that nearly half forty seven point five percent of organizations it assessed for interim PCI DSS compliance had failed to maintain all security controls first it's necessary to determine your merchant level and whether you need to submit a self-assessment questionnaire saq and if so which one poor a report on compliance roc there are several types of saq each of which has different requirements some require internal and external vulnerability scans and regular penetration testing an ROC on the other hand must be conducted by a PCI qualified security Assessor qsa we will issue a formal report to the PCI security standards Council to attest that your organization is in full compliance with the standard whatever your requirements of pci-dss gap analysis is a useful first step to determine your organization's current compliance levels and outline the specific steps needed to achieve full compliance with the standard it includes a detailed review of compliance activities such as on-site interviews with key staff an assessment of the in scope system components and configurations and a physical and logical data flow analysis in addition to examining out of scope components [Music]