What is PCI DSS? Requirements and How to Comply (2024)

Online shopping is now commonplace for most of us. We click to buy, our information is processed seamlessly, and we have confidence that our financial data is safe. But have you ever wondered what goes on behind the scenes to ensure this trust?

The answer lies in a set of security standards called PCI DSS. Below we explain the requirements behind this acronym and what it means for both online merchants and customers.

What is PCI DSS (Payment Card Industry Data Security Standard)?

PCI DSS stands for Payment Card Industry Data Security Standard. It’s a set of security requirements mandated by the major credit card brands (Visa, Mastercard, American Express, Discover, JCB) to ensure that companies that handle cardholder data can do so securely. Think of it as a rulebook for protecting your customers’ sensitive payment information.

PCI DSS is overseen by the PCI Security Standards Council (PCI SSC), an independent group of experts formed in 2006. These standards apply to all organizations that accept, transmit, or store credit card information, regardless of size or transaction volume.

This includes businesses such as stores and service providers, but also non-profit organizations and other businesses that handle card payments. Even if you outsource your payment processing, it’s important to remember that you’re still responsible for complying with PCI DSS to ensure your customers’ credit card data is protected.

What is the purpose of PCI DSS?

The main purpose of PCI DSS is to keep sensitive cardholder information such as debit and credit card numbers, expiration dates, and security codes secure. Payment Security PCI DSS helps businesses reduce data breaches and identify theft and credit card fraud, and it sets clear expectations for how organizations should handle sensitive information, creating a more secure environment for all involved.

The Six Principles of PCI DSS

PCI DSS covers 12 major requirements, organized into six groups called control objectives. The control objectives are:

1. Build and maintain secure networks and systems
2. Protect cardholder data
3. Maintain a vulnerability management program
4. Implement strong access control measures
5. Regularly monitor and test your network
6. Maintain information security policies

12 PCI DSS Requirements

The latest version of the standard is PCI DSS 4.0 (released March 2022) and includes: 12 Key Compliance Requirements:

1. Install and maintain a firewall configuration to protect cardholder data.
2. Do not use vendor-supplied defaults for system passwords and other security parameters.
3. Protect stored cardholder data.
4. Encrypt transmission of cardholder data over open, public networks.
5. Protect all systems against malware and regularly update your antivirus software or programs.
6. Develop and maintain secure systems and applications.
7. Restrict access to cardholder data based on business need to know.
8. Identifies and authenticates access to system components.
9. Restrict physical access to cardholder data.
10. Track and monitor all access to network resources and cardholder data.
11. Regularly test security systems and processes.
12. Maintain policies that address information security for all employees.

PCI DSS Compliance Levels

Merchants must comply with PCI DSS. How they prove compliance depends on the volume of transactions and the methods they process. There are four main levels of PCI DSS compliance for businesses and organizations:

Level 1

Level 1 businesses process over 6 million card transactions per year and face the most stringent requirements. Large merchants at this level are subject to the following requirements:

• We work with a third-party Qualified Security Assessor (QSA) to complete an annual Report on Compliance (ROC).
• Conduct quarterly network vulnerability scans and annual penetration tests
• Complete a QSA-approved Attestation of Compliance (AOC)

Level 2

Merchants who process between 1 million and 6 million card transactions per year qualify as Level 2 merchants. At this level, they must:

• Complete the Annual Self-Assessment Questionnaire (SAQ)
• Conduct quarterly network vulnerability scans
• Complete the AOC

You may need to have a PCI Level 2 SAQ attested by a third-party QSA firm, and you may also need to submit quarterly network vulnerability scans.

Level 3

This level applies to all businesses and organizations that process between 20,000 and 1 million card transactions per year, and all e-commerce merchants. Level 3 requires:

• Complete the annual SAQ
• Conduct quarterly network scans
• Complete the AOC

You may also be required to submit quarterly network vulnerability scans.

Level 4

Level 4 applies to small businesses with fewer than 20,000 transactions per year. Level 4 requires that you:

• Complete the annual SAQ
• Quarterly network scans (reporting not required)
• Complete the AOC

You may also be required to submit quarterly network vulnerability scans.

The pros and cons of PCI DSS compliance

While there is a cost to setting up and maintaining PCI DSS, it is far less than the problems that a data breach could cause. And the trust that PCI DSS compliance builds with your customers makes it well worth the investment. Here’s what you can expect:

Benefits of PCI DSS

• Reduced security headaches: Increased data security means it will be harder for hackers to steal customer information, reducing stress and disruption for your business.
• Stronger customer relationships: Complying with PCI DSS shows your customers you’re committed to protecting their financial information, building trust and loyalty.
• Future cost savings: By proactively protecting your sensitive data, you can avoid the steep fines, costly litigation, and reputational damage that can come with a data breach.

Disadvantages of PCI DSS

• Setup costs: PCI DSS compliance requires upfront costs for security tools and employee training.
• Ongoing management: Maintaining PCI compliance requires regularly checking your systems, updating security protections, and keeping your employees up to date.
• A changing landscape: Due to evolving threats and technological advancements, the industry is constantly changing, and companies must adapt to keep up.
• complicated: The details of PCI DSS can be complicated, and depending on the size and type of your business, you may need expert help to set it up properly.

PCI DSS Compliance Best Practices

Here are some important best practices that can help you stay compliant and handle your customers’ payment information securely.

1. Restrict access: Customer personal information should only be released on a need-to-know basis. Only employees with a job-related need should have access to cardholder data.
2. Build a strong defense: To protect your system, invest in security tools such as firewalls and antivirus software and update them regularly.
3. Keep them separate: A secure network infrastructure involves segmenting the network to separate cardholder data from other parts.
4. Leave it encrypted: When we store or transmit customer data, we use encryption to scramble the information to make it unreadable to unauthorized users.
5. Carry out regular checks: Keep your systems and software up to date with security patches.
6. Train your team: Educate and train your employees on data security best practices to avoid accidental breaches.
7. Enforce strong passwords: Enforce password complexity requirements and regular password changes, Two-factor authentication.
8. Save the audit log: Maintain detailed audit logs to monitor system activity.
9. Let’s plan it: Develop a plan for responding quickly and effectively to security incidents.
10. Let’s make it official: Establish a company-wide information security policy that governs how cardholder data will be handled and protected.

Remember, PCI DSS compliance is an ongoing process, and following these best practices can significantly reduce the risk of a data breach and protect your business and your customers.

Compliant with Shopify Payments

Good news for Shopify merchants: we’ve done the work for you. Shopify is PCI DSS compliantThis is applied by default to all stores powered by Shopify.

This means your billing and shipping information is stored securely on PCI compliant servers. We validate our compliance through annual assessments and proactively manage ongoing risk. Our compliance covers all six PCI standard categories and applies to all stores using our platform.

This means that if you choose Shopify to run your store, you can rest easy knowing that we maintain Level 1 PCI certification and have spent a lot of time and money to protect every transaction. Your store, shopping cart, and web hosting are all protected.