Share this article
What is PCI compliance? A PCI DSS compliance overview
What is PCI compliance? A PCI DSS compliance overview
Every time a new data breach hits the news, business leaders feel a fresh sensation of stress in the pits of their stomachs: the fear that they could be next. Data breaches can destroy a company’s reputation and ultimately its future. How can you protect your customers’ payment data and protect your business from a breach?
One way to know if you’re secure is by maintaining PCI compliance. Let’s break down the details of what PCI compliance is, an overview of PCI DSS compliance, and how you can use it as an asset for your business.
What is PCI compliance?
You’ve probably heard the term “PCI compliance,” but the full name is PCI DSS compliance. PCI DSS compliance stands for payment card industry data security standard compliance. That name makes it much clearer: PCI compliance involves adhering to a specific set of standards and practices that are meant to protect payment data.
PCI DSS includes 12 specific requirements that a company needs to meet to be PCI compliant. These PCI DSS standards are developed and maintained by the PCI Security Standards Council. This independent council was formed by the major credit card companies such as:
- Mastercard
- Visa
- American Express
PCI DSS was created by these companies in an effort to better secure consumers’ payment data.
It’s important to note that PCI compliance is not a legal requirement. It’s more of a requirement throughout the payments industry. If you process payments or accept credit card payments in any way, PCI compliance is a way to ensure that major credit card companies and banks will continue working with you. PCI compliance also proves that you are maintaining trust with partners throughout the payment industry.
Who needs to be PCI compliant?
PCI compliance is considered to be a necessity within the business world for anyone who processes, stores, or transmits payment information. As we noted, PCI compliance isn't a legal requirement, so you won’t face direct legal or criminal consequences for skipping PCI compliance.
However, without PCI compliance, you may end up with fewer payment options. Without PCI DSS compliance you may even end up with fines of thousands of dollars per month from payment brands like Visa and Mastercard.
PCI compliance requirements
The PCI compliance requirements are designed to make your organization more secure, but before you dive in it’s helpful to get an understanding of the essentials.
What are the PCI compliance requirements?
The PCI DSS compliance requirements in their entirety are very detailed and complex, of course. At the core, there are 12 PCI DSS requirements, each with its own supporting details. Briefly, those requirements for PCI compliance include:
- Protecting cardholder data with a firewall
- Changing default passwords
- Protecting any stored cardholder data
- Encrypting cardholder data while it’s transmitted
- Maintain anti-virus software
- Keep applications and systems secure
- Grant the minimum required access to cardholder data
- Set up unique IDs for each person with computer access
- Limit physical access to cardholder data
- Monitor access to cardholder data
- Test security systems routinely
- Establish security policies for personnel
These 12 requirements give you a broad view of what PCI compliance covers.
Benefits of PCI DSS compliance
The idea of hefty fines from major banks could be enough of a reason to put PCI DSS compliance on your priority list. But you don’t just want to adhere to PCI DSS to avoid penalties. There are strong benefits of PCI compliance too.
Selling to the enterprise
One of the biggest motivations for PCI compliance is the ability to sell to large enterprise companies that require their vendors to be PCI DSS compliant. “Are you PCI compliant?” is one of the first questions that an enterprise asks before moving forward with a financial partnership. You’ll want to make sure you can confidently answer yes when asked if you’re PCI DSS compliant and make your partners confident.
Some organizations will require PCI compliance to even sign a contract or consider a vendor during the RFP process. Companies use PCI compliance to prove trust during the sales process and as a way of establishing security assurance throughout the partnership.
PCI compliance open options for payment processing
In any type of business, the easier you make your payment process, the more likely consumers will follow through with a purchase. One way to make your payment process easier is to give customers plenty of payment options and PCI DSS compliance is one of the most effective ways to offer more payment options. Being PCI compliant allows you to work with more payment brands so you can offer your customers all of their favorite payment options.
PCI compliance offers enhanced consumer trust
Data breaches are all over the news, and many of your customers have probably dealt with the hassle of a data breach personally. They know the frustration of:
- Canceling credit cards
- Disputing purchases
- Potentially sending evidence for disputed purchases
- Waiting for new credit cards
- Changing their payment information on online platforms
If you’re PCI compliant, you can ensure customers that you are adhering to the most respected standards to protect their data. PCI compliance builds more trust and may lead to more loyal customers.
PCI DSS compliance lowers risk for data breaches
PCI DSS exists for a reason: it’s protecting your customers’ payment data. If you fall victim to a data breach, it damages your company’s reputation and hurts your profits because you may be financially liable for any damages. If you adhere to the standards of PCI DSS, you’ll know that you have secured the safety of your consumers and your own business as much as you can.
PCI DSS compliance levels
PCI compliance isn’t just a “yes or no” situation. There are multiple levels of compliance you can accomplish. PCI DSS separates merchants into four levels based on the number of credit card transactions they process annually:
- Level 1: over six million transactions per year
- Level 2: one million to six million transactions per year
- Level 3: 20,000 to one million transactions per year
- Level 4: under 20,000 transactions per year
The most notable difference in PCI compliance is that level 1 merchants must have an audit performed by a third-party auditor, along with additional paperwork. Merchants in levels 2-4 fill out a self-assessment questionnaire instead of having an external audit.
There are advantages to higher-level PCI compliance, like a stronger show of trust and security, but if you are a level 2-4 merchant, your “bare minimum” for PCI compliance is much lower.
Learn more about PCI DSS
Guide to PCI compliance costs
PCI compliance in 3 steps
Automate your PCI DSS compliance
No items found.
FEATURED VANTA RESOURCE
The ultimate guide to scaling your compliance program
Learn how to scale, manage, and optimize alongside your business goals.
PCI Compliance Selection Guide
Determine Your PCI Compliance Level
If your organization processes, stores, or transmits cardholder data, you must comply with the Payment Card Industry Data Security Standard (PCI DSS), a global mandate created by major credit card companies. Compliance is mandatory for any business that accepts credit card payments.
When establishing strategies for implementing and maintaining PCI compliance, your organization needs to understand what constitutes a Merchant or Service Provider, and whether a Self Assessment Questionnaire (SAQ) or Report on Compliance (ROC) is most applicable to your business.
Answer a few short questions and we’ll help identify your compliance level.
1
2
3
4
!
👍
Does your business offer services to customers who are interested in your level of PCI compliance?
Identify your PCI SAQ or ROC level
The PCI Security Standards Council has established the below criteria for Merchant and Service Provider validation. Use these descriptions to help determine the SAQ or ROC that best applies to your organization.
Good news! Vanta supports all of the following compliance levels:
SAQ A
A SAQ A is required for Merchants that do not require the physical presence of a credit card (like an eCommerce, mail, or telephone purchase). This means that the Merchant’s business has fully outsourced all cardholder data processing to PCI DSS compliant third party Service Providers, with no electronic storage, processing, or transmission of any cardholder data on the Merchant’s system or premises.
Get PCI DSS certified
SAQ A-EP
A SAQ A-EP is similar to a SAQ A, but is a requirement for Merchants that don't receive cardholder data, but control how cardholder data is redirected to a PCI DSS validated third-party payment processor.
Learn more about eCommerce PCI
SAQ D
for service providers
A SAQ D includes over 200 requirements and covers the entirety of PCI DSS compliance. If you are a Service Provider, a SAQ D is the only SAQ you’re eligible to complete.
Use our PCI checklist
ROC
Level 1 for service providers
A Report on Compliance (ROC) is an annual assessment that determines your organization’s ability to protect cardholder data. If you’re a Merchant that processes over six million transactions annually or a Service Provider that processes more than 300,000 transactions annually, your organization is responsible for both a ROC and an Attestation of Compliance (AOC).
Automate your ROC and AOC
Download this checklist for easy reference
Questions?
Learn more about how Vanta can help. You can also find information on PCI compliance levels at the PCI Security Standards Council website or by contacting your payment processing partner.
Related resources
The compliance news you need. Delivered securely to your inbox.
Subject to Vanta's Privacy Policy, you agree to allow Vanta to contact you via the email provided for marketing and other purposes
