What is the PCI DSS standard? Issues and compliance
Credit card payments are omnipresent. With the rise of e-commerce, mobile applications and payment terminals, businesses process millions of sensitive transactions every day. And this comes with a number of risks: cyberattacks targeting bank card data are on the rise.
To deal with this crucial issue and avoid hacking bank data, the PCI-DSS (Payment Card Industry Data Security Standard) has established itself as the global reference standard for payment security.
In this article, we offer you a guide to understand the PCI DSS standard, its challenges, its importance and its requirements. We will also explain how to ensure compliance with this standard.
PCI DSS: definition and challenges
The payment card industry security standard (PCI DSS) is an IT security standard that concerns all players in the electronic banking chain. Its objective is clear: protect sensitive data cardholders and reduce the risk of fraud related to payments.
La PCI DSS compliance thus invites all companies (retailers or service providers) that store, process or transmit bank card data to comply with a number of safety rules.
Initially founded by the main payment card companies (Visa, Mastercard, Mastercard, American Express, Discover and JCB), the standard is now managed by the PCI Security Standards Council (PCI SSC), an independent organization.
Even though it is not directly a legal requirement, compliance with the PCI DSS standard is a contractual requirement imposed by bank card networks on any organization that processes card payments.
💡 What to remember - The key principles of PCI DSS:
- Protect bank card data throughout their life cycle (collection, transmission, storage, processing);
- Define a common framework applicable to all companies involved in the payment chain;
- Harmonize security practices and establish a recognized global standard.
Who is affected by PCI DSS compliance?
The PCI DSS standard applies to any organization that stores, processes, or transmits payment card data.
Many businesses are concerned:
- Retailers (physical or online);
- Service providers (hosts, PSPs, cloud providers);
- developers of payment solutions;
- Financial institutions and their subcontractors.
What are the PCI DSS requirements?
The PCI DSS standard is based on 12 requirements operational and technical (including around 300 sub-requirements in total), each aimed at contributing to the security of cardholder data.
These measures are organized around 6 main objectives :
Objective 1: Build and maintain a secure network
- Installing and maintaining a firewall configuration
The firewall is used to control incoming and outgoing network traffic and to block all transmissions that do not meet security requirements. It is the first line of defense against various threats, so it needs to be tested and updated regularly.
- Do not use passwords or default security settings
Passwords and default settings are one of the gateways for cybercriminals to compromise a system. Credentials should be unique and secure.
Goal 2: Protect cardholder data
- Protect stored data
Data protection, whether in digital or physical form, is one of the key criteria for PCI DSS compliance. To avoid any fraudulent use of stored data, businesses must ensure that they implement the necessary protection measures (data encryption, regular deletion of unnecessary data, etc.).
- Encrypt the transmission of sensitive data on open public networks
Cybercriminals can attempt to intercept sensitive data when it is transmitted over open, easily accessible public networks. To avoid this, data must be encrypted prior to transmission with strong security and cryptographic protocols.
Objective 3: Maintain a vulnerability management program
- Protect systems against malware and update anti-virus programs or software regularly
Antivirus software is essential to protect the business from malicious programs. If data is stored on external servers, the company must ensure that the service provider concerned also offers a secure environment.
- Develop and maintain secure systems and applications
Systems should be kept up to date at all times by regularly applying updates and patches offered by network providers to address security breaches.
Objective 4: Implement access control measures
- Restrict access to data: business needs
Human error remains one of the main causes of various data breaches. To limit this risk, only individuals who really need to know the data should have access to it.
- Identify and authenticate access to system components
Each employee must have a unique ID to access sensitive information. This makes it possible to keep track of who is accessing the systems and when.
- Restrict physical access to data
Only authorized members should be able to physically access the servers that store the data. These must be installed in a secure environment.
Objective 5: Monitor and test networks
- Track and monitor all access to network resources and incumbent data
Monitoring user activity makes it possible to identify the origin of a vulnerability or to detect any malicious behavior internally.
- Regularly test security systems and processes
IT systems are constantly facing new vulnerabilities. Tests should be carried out regularly to detect them in time and maintain data security.
Objective 6: Maintain an information security policy
- Maintain a clear security policy and communicate with all employees
A security policy that complies with the PCI DSS standard must be implemented across the organization to be effective. To achieve this, all employees must be informed of safety regulations and what is expected of them.
To remember: the PCI DSS standard is based on 12 major requirements, organized into 6 main objectives. They cover system configuration, data protection and encryption, vulnerability management, access control, continuous monitoring, and security governance.
Even though the official documentation mentions nearly 300 sub-requirements, it is this foundation of 12 rules that is the core of PCI DSS compliance.
All of these requirements should not be treated independently: they form a coherent system, where the weakness of one link can compromise the entire chain.
How do you ensure PCI DSS compliance?
PCI DSS compliance levels
The PCI DSS distinguishes 4 levels of compliance which determine the requirements for compliance with the PCI standard.
These levels are based on the annual trading volume of merchants:
- Level 1: more than 6 million, all channels combined
- Level 2:1 to 6 million, all channels combined
- Level 3:20,000 to 1 million (electronic transactions)
- Level 4: - 20,000 (electronic transactions)
The requirements to comply with the PCI DSS standard
Each year, companies are subject to an evaluation carried out by an external entity (a qualified security evaluator or QSA — Qualified Security Assessors), to draw up a certificate of conformity.
Several conditions may be requested depending on the level of compliance:
- Self-assessment questionnaire (SAQ — Self Assessment Questionnaire): composed of closed-ended questions, this questionnaire makes it possible to prove that the company is taking the appropriate measures to preserve data security. There are different types of questionnaire depending on the nature of the processing of bank data.
- Vulnerability scan : these analyses are essential to identify possible security breaches. These scans must be performed by a vendor approved by the PCI-SSC every quarter to maintain compliance.
- Certificate of conformity (AOC): this is a declaration completed and signed by the merchant or service provider to attest to the completion of the tests. For level 1 retailers, it is accompanied by a compliance report.
- Compliance report (ROC): unlike the certification and the self-assessment questionnaire, the compliance report is written by a qualified evaluator, appointed by the PCI-SSC, who attests to compliance with the PCI-DSS rules independently.
Summary of requirements by level of compliance:
Level 1:
- Annual audit by a QSA
- Quarterly scan by an approved scan provider (ASV)
Level 2:
- SAQ
- Quarterly scan
Level 3:
- SAQ
- Quarterly scan
Level 4:
- SAQ recommended
In summary: the higher the trading volume, the more stringent the requirements. A small level 4 e-merchant may be satisfied with a self-assessment questionnaire, while a large level 1 bank will have to undergo a comprehensive audit by a qualified auditor (QSA) every year.
What are the risks of non-compliance with PCI DSS?
Not complying with PCI DSS requirements exposes businesses to serious financial consequences, including:
- Fines and sanctions : up to several hundred thousand euros per incident, depending on the size of the company, the number of customers concerned, the duration and the degree of non-compliance;
- Losses due to fraud ;
- Decreased sales ;
- Hidden costs : surveys, crisis communication...;
- Suspension of the right to process card payments, etc.
In addition to fines and penalties, businesses that don't comply with PCI DSS compliance may face less tangible, but just as harmful, repercussions, such as loss of customer trust And a decline in reputation in the event of a data leak.
💡 A striking example : in 2013, the American chain Target suffered a massive bank card data breach (data from around 40 million customer credit and debit cards was stolen). Consequences for the business: a total cost of more than 200 million dollars and a lasting damage to its reputation.
In Europe, PCI DSS compliance does not exempt from other regulatory obligations either. It must be articulated with the RGPD (protection of personal data), the NIS2 directive (information system security) and, for financial services, The DORA regulation. Adopting an integrated approach helps to avoid silos and to strengthen the overall resilience of the organization.
PCI DSS: best practices and mistakes to avoid
Best practices
- Automate the monitoring of critical systems.
- Conduct regular penetration tests.
- Document all procedures and evidence of compliance.
- Offer training to your employees.
Common mistakes
- Consider the PCI DSS as a one-off project instead of a continuous improvement process.
- Limit yourself to a “compliance check” without any real improvement in security.
- Neglecting employee awareness.
PCI DSS and GRC: an integrated approach to cybersecurity with Egerie
The standard PCI-DSS is much more than a regulatory constraint: it is an essential foundation for cybersecurity and a company's GRC (Governance, Risk and Compliance) strategy. Its compliance protects not only payment data, but also the reputation and resilience of businesses.
The Egerie platform reinforces the security of your critical information systems while simplifying the compliance process:
- Cyber mapping offering a precise vision of risks;
- Simulation of incident scenarios to assess the potential impacts on company activities at an early stage;
- Integrated action plans promoting collaborative and effective monitoring of the implementation of security measures;
- Real-time dashboards to manage governance and facilitate decision-making;
- Centralized documentation facilitating audits and continuously attesting to compliance.
Take the example of a medium-sized e-merchant: with Egerie, he can map his payment flows, identify the vulnerabilities of his servers and set up an action plan aligned with PCI DSS. The result: simplified compliance and a concrete reduction in the risk of fraud.
Ask a free demo and find out how Egerie can simplify your compliance with an integrated approach.
PCI DSS FAQ
Who needs to be PCI DSS compliant?
Any company that stores, processes or transmits card payment data is concerned: merchants, service providers, hosting providers and financial institutions.
How do you prove PCI DSS compliance?
Depending on its level, a company must complete an SAQ (Self-Assessment Questionnaire) or undergo an annual audit by a QSA (Qualified Security Assessor).
What are the penalties for non-PCI DSS compliance?
Businesses risk fines, loss of the right to process card payments, and major reputational damage.
Do you need to renew your PCI DSS compliance?
Yes. PCI DSS compliance must be validated every year, in particular with mandatory quarterly vulnerability scans.
How long does it take to be PCI DSS compliant?
It depends on the size and maturity of the business. For an SME, a few months may be enough. For a large complex organization, the compliance project can last 6 to 12 months.
How can cardholder data be compromised?
Cyberattacks can exploit various security holes in operating systems and devices to access sensitive banking data, for example: card reader, payment system database, storage network, online portal, wireless network, etc.
What is the difference between PCI DSS and ISO 27001?
PCI DSS is a standard specific to credit card payments, whileISO 27001 defines a general framework for managing information security. The two approaches are complementary.
Is PCI DSS mandatory in France and Europe?
Yes, but not as a law: it is the card networks (Visa, Mastercard, etc.) that contractually impose PCI DSS compliance on all companies that process payments. At the same time, other texts such as the RGPD or NIS2 reinforce security obligations at the legal level.
