In the dynamic world of payments, transaction security is of paramount importance. When we speak with our customers and partners, the topic of payment security and PCI compliance always comes up. While there is a lot of useful information about payment security available, the industry is also filled with many questions regarding PCI. So, with the latest PCI Data Security Standard update and the release of the latest security standards for payments terminals, I thought it would be a great opportunity to provide a quick refresher on PCI compliance and the various security standards merchants need to know.
The PCI Council and its Various Security Standards
The Payment Card Industry Security Standard Council (PCI SSC) is a global, open body created to develop, enhance, distribute and assist with the understanding of security standards for payment security. The council also provides critical tools needed to implement various security standards.
Below is a list of all the different security standards from PCI SSC that are relevant for organizations accepting electronic payments:
1. PCI DSS:
The Payment Card Industry Data Security Standard (PCI DSS) covers the security of the cardholder data environment—the IT systems that process, store, and transmit credit and debit card information. Most merchants are familiar with PCI DSS through their annual assessments. As the threat landscape that merchants and payments providers face is not static, neither are the standards for the protection of the cardholder data environment. PCI SSC has released updates to version 3 – the latest being version 3.2 – in response to those evolving threats.
2. PA-DSS:
The Payment Application Data Security Standard (PA-DSS) covers security for payment applications that access cardholder data. A payment application is a software that is developed to help merchants process electronic payments including magstripe, EMV and contactless transactions. This standard ensures that third party payment applications properly handle cardholder data and meet industry best practices for secure application development.
3. PCI-PTS:
The Payment Card Industry PIN Transaction Security (PCI-PTS) standard is a set of technical and operational requirements for payment terminals focused on protecting cardholder data. The PCI PTS standard is modular, covering hardware and firmware security requirements to protect against physical, logical and network tamper attacks. The PCI PTS requirements now include security requirements for open protocols – such as TCP/IP, TLS, Bluetooth, and USB – and the ways cardholder data are read and encrypted through the Secure Reading and Exchange of Data (SRED) module.
PCI PTS standards are updated on a three-year cycle. Unlike most other PCI standards, PCI PTS does not involve point-in-time assessments. Instead, terminals are submitted to approved third-party labs for evaluation against the then-current PTS version. On approval, a Letter of Approval (LOA) is issued with the validity period for the evaluated version of the specification.
Terminal manufacturers cannot ship a terminal once the LOA for the terminal has expired, however repairs and warranty replacements are still allowed. The expiration of a terminal’s PCI PTS LOA does not, per se, affect the ability of a merchant to continue to use the terminal. Sunset dates for terminals are set by the individual card brands and PCI, both of which recommend that merchants choose terminals that meet the highest security standards and also meet their specific needs.
4. PCI P2PE:
The Payment Card Industry Point-to-Point Encryption (PCI P2PE) standard is a set of security requirements that cover all aspects of a P2PE solution, including the payment terminal, terminal application, deployment, key management and decryption environment. PCI P2PE validated solutions are the “gold standard” for the protection of cardholder data. Merchants that use PCI P2PE validated solutions receive significant de-scoping of their PCI DSS assessments through the use of Self-Assessment Questionnaire (SAQ) P2PE. PCI P2PE validated solutions are listed on the PCI SSC website.
Who Needs to be PCI Compliant?
Accepting electronic payment involves handling of sensitive cardholder information, and keeping it secure needs to be top priority for businesses that accept, processes, or transmits credit card information. In simple terms, if you accept electronic payments for selling goods or services, your business needs to be PCI compliant. Businesses that fail to meet the relevant PCI compliance standards not only put sensitive cardholder data at risk, but they are also subject to heavy fines.
Evolution of PCI Standards
The technology to accept payment is constantly evolving, and so are the ways to protect sensitive customer information, such as credit card details, from cyber threats. The PCI SSC is constantly working toward improving its security standards to align with the changing needs of the payments industry. The last iteration of the PCI DSS standard expired in October 2015, and a new version—PCI DSS 3.2— will be enforced starting in November. These updates include a number of clarifications, updated guidance, and some new requirements. You can read more about the new version on the PCI Security Council’s website.
PCI Webinar on Demand
I hope this blog post has been helpful. To learn more about PCI security standards and gain a clear understanding of PCI and its latest updates, watch this free webinar entitled, “PCI at the POS / What’s New, What’s Next and What Merchants Can Do to Simplify Compliance.”
Rob Martin is the VP of Security Solutions at Ingenico Group / North America
