Website Legal Requirements 6 – PCI DSS

The sixth blog of my Website Legal Requirements series, explains how the Payment Card Industry Data Security Standard (PCI DSS) affects not only your E-Commerce site, but your website server too, and what you should do in order to comply.

 

The Payment Card Industry Data Security Standard (PCI DSS) was created to help prevent credit card fraud with organisations that process credit or debit card payments. It ensures controls around data are increased and reduces exposure to compromise. The standard applies to all organisations which hold, process, or pass cardholder information from any card branded with the logo of one of the card brands.

The industry standard PCI DSS, includes 12 key requirements for organisations that accept or processes card payments:

  1. Install and maintain a firewall configuration to protect data
  2. Do not use vendor-supplied defaults for passwords or other security parameters
  3. Protect stored data
  4. Encrypt the transmission of cardholder data and sensitive information
  5. Use and regularly update anti-virus software
  6. Develop and maintain securer systems and applications
  7. Restrict access to data by business need-to-know
  8. Assign a unique ID to each person with computer access
  9. Restrict physical access to cardholder data
  10. Track and monitor all access to network resources and cardholder data
  11. Regularly test security systems and processes
  12. Maintain a policy that addresses information security

How Does This Affect My Website?

It is not only your website that are affected, but the server your website is hosted on also. You should check with your web hosting developer and e-commerce system provider that:

  • you have a suitable firewall on the server
  • system passwords are secure
  • if you save credit/debit card that it is protected, the website have a suitable SSL certificate to encrypt transmitted data
  • the server uses anti virus software
  • the systems are secure and access is only granted to those who need it.

Sources & More Info:
https://www.pcisecuritystandards.org/
http://www.visaeurope.com/aboutvisa/security/ais/requirements.jsp
http://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Security_Standard