PCI Compliance Checklist: 12 Steps To Ensure Staying Compliant

Can your customers trust you with their secure credit card information?  If not, your credibility and bottom line may take a hit.

Every company that accepts credit card payments from customers must adhere to the Payment Card Industry and Data Security Standards. Commonly abbreviated as PCI DSS, these standards protect online consumers and e-commerce service providers.

Reading the news, it is easy to understand why PCI compliance standards matter. We often hear stories of data breaches. 

Large companies like Target, Uber, and Equifax have also been impacted. Smaller companies are also vulnerable.

Building trust with customers is a priority for every business. PCI Compliant Hosting should be at the top of your security checklist.

Customers who pay you with credit cards do not want to worry about identity theft. It is your job to do whatever you can to minimize their risk.

What is PCI Compliance? What does PCI mean?

Let’s talk about why PCI standards matter. There are two things that PCI standards are supposed to ensure.

1. The secure storage of credit card data on site. This concern applies only to companies that store credit card data. If you do not save data, then you do not have to worry about a security breach. Secure storage should include both virtual and physical security.
2. The secure transmission of credit card data across public networks. Any time data is in transition; it can be vulnerable. Passwords, PIN numbers, and other methods can keep information safe.

PCI standards protect sensitive cardholder information. They apply whether the data is at rest or in transit, protecting your customers from breaches and identity theft.

How do PCI Compliant Standards Work?

If your company accepts, stores, or transmits credit card data, you must adhere to PCI standards. However, those standards vary depending on your circumstances.

We are not going to run down all the standards. Though, we want to give you an idea of how PCI compliance works.

How do you know which level of PCI security is required? Here are some things to keep in mind:

1. PCI standards were created by the major credit card companies such as Visa, MasterCard, JCB International, and American Express. Their purpose is to protect cardholders.
2. There is no such thing as PCI certification. However, you must prove that your company is PCI compliant.
3. The level of compliance you must adhere to is determined by the annual volume of your credit card transactions.
4. Complying with PCI standards is not cost-free. It may cost you anywhere from $1,000 to $50,000 annually.
5. There are penalties if you are not compliant with PCI standards.

It is your job to determine what level of PCI compliance is needed. Then, you will need a PCI compliance checklist. Keep in mind that compliance is an ongoing issue. You will need to continually update your security to comply with PCI standards.

What’s in the PCI Compliance Guide?

Lack of merchant PCI compliance can cost your company money and reputation. Having a checklist to refer to can help you complete all the necessary steps to get compliant.

You should use the PCI DSS Audit checklist to make sure you meet each requirement. Remember, the requirements may change based on your transaction volume. It is your job to monitor your transactions and choose the right level of compliance.

To make it a bit easier for you, we created a short guide to PCI self-assessment. It is essential to be thorough as you work your way through this checklist. Keep track to ensure that you have not missed any vital steps.

1. Install and Maintain a Firewall

To meet PCI standards, install a reliable firewall to shield your network security. The firewall is your first line of defense to protect cardholder data, as it helps block unauthorized access to your network.

To enhance its efficiency, you should have a clear firewall configuration policy. Run regular tests on your firewall and ensure that your hosting service has one in place.

2. Do Not Use Vendor-Supplied Defaults

Keeping track of passwords can be a hassle. Some companies cut corners by using vendor defaults. Compliance with PCI standards means assigning unique passwords.

Every password you use should adhere to password best practices. Including lower-case and capital letters, numbers, and symbols makes passwords secure. Using defaults makes it easy for would-be hackers to get into your system.

3. Protect Stored Cardholder Data

Protecting cardholder data by PCI standards requires you to think about your system’s vulnerabilities. You will need to put electronic and physical barriers in place.

Your first loyalty should be to the customers who put their trust in you. Security measures may include:

• Strong password policies
• Authentication protocols
• Locked servers
• Locked storage cabinets
• Additional steps as needed

Making an inventory of existing measures can help you spot problems.

4. Encrypt Transmission of Cardholder Information

Protecting stored cardholder information is a must for complying with PCI standards, but it is equally important to protect it while it is in transit.

If you are sending customer data through an open network, you should make sure to encrypt it. This step adds a layer of protection to protect it from hackers, as they would not be able to read it without encryption keys.

PCI compliance best practices do not recommend storing sensitive data. PINS, security codes, and other verification information should be adequately secured and encrypted both at rest and in transit.

5. Use and Update Anti-Virus Software

To protect cardholder information and comply with PCI standards, you must use anti-virus software. That might seem obvious, but it is not uncommon for companies to have software that’s out of date.

Your software should be reliable and from a company with a good track record. It is your job to update the databases regularly. Train workers to update databases on all devices they use for work and make sure you also run regular scans on your server.

6. Develop and Maintain Secure Systems and Applications

Many companies use both proprietary and third-party systems and applications. To comply with PCI standards, you need to ensure that all systems and software are secure.

The use of third-party apps is sometimes beneficial, but caution is required. You must be confident that their presence on your network is not risking your data. Not all apps are safe to use, so choose wisely before installing anything new.

7. Restrict Access to Cardholder Data

As a business owner, you need to trust your employees. No boss wants to believe that their employees would be careless with customer data. That is understandable, but you must take steps to restrict access as needed.

According to PCI standards, people who do not need access to cardholder data should not have it. Most of your employees will not require access. Only those who need cardholder information should have access to it. Taking this simple step minimizes the risk of an internal data breach.

8. Assign Unique IDs to All Users

Limiting access to secure data reduces the chance of an internal breach. That does not mean that you should not track user activity and access. We recommend this as an additional security measure to adhere to PCI standards.

Assigning each user with access to your system a unique ID is essential. This simple step can help you keep track of who’s accessing your data.  When each user has an ID and password, you can monitor who accesses stored data. Letting employees know that their activity is observed can add an extra layer of protection.

9. Restrict Physical Access to Cardholder Data

Preventing hackers from accessing cardholder data electronically is essential, but it is not the only step you should take. You must ensure that only authorized staff who require physical access to cardholder data have it.

This step applies both to servers and other hardware as well as paper records. If you keep any printed records of cardholder information, store them in a secure area. Access to the area should be limited. These areas must not be left unlocked or unguarded.

10. Track and Monitor All Access to Cardholder Data

You want to trust your employees, but you cannot afford to assume the best. Protecting customer data must be your top priority.

If you want to protect cardholder information, it is essential to have a tracking and monitoring system in place. That way, you can see which employees have accessed secure data, as required by PCI standards.

Employees may bristle at the notion of being monitored. That is understandable, but it does not change your obligation to customers. Put a monitoring system in place and then review it periodically. Any unusual or unexpected activity by employees should be addressed immediately.

11. Test Security Systems and Processes

Installing security systems, firewalls, antivirus software, and internal security is essential. These steps are vital to keeping your customers’ data safe, but so is ongoing testing of your existing systems.

Think of these tests as fire drills. We make a point of testing fire alarms and evacuation methods in schools and offices. Likewise, you should test your security systems regularly to ensure they work.

If a test reveals a breach or vulnerability, you must address it immediately. Even the best security measures can fail, so do not make the mistake of assuming that yours are infallible.

12. Write and Enforce a Security Policy

The final step on our PCI DSS checklist is to write and implement a comprehensive security policy. Even with protections in place, you must communicate and work to enforce your policy. Ever employee, third-party vendor, and a customer should know about it.

Letting people know about your policy does several things at once.

1. It lets customers know that you take their privacy seriously and want to protect their data.
2. It ensures that all personnel understands the importance of safeguarding cardholder data.
3. It puts your staff on notice that you will be monitoring their access to secure information.

Your written security policy should include an overview of how you protect customer data. It should also spell out password and access requirements for staff. Make sure to specify your guidelines for accessing data on BYOD and mobile devices. All essential personnel should be made aware of PCI standards and how to comply with them.

Always Verify PCI Compliance

Maintaining an atmosphere of trust with your customers is essential. In fact, a lack of confidence can affect the overall well-being of your business.

Complying with PCI standards is key to inspiring trust in your customers, prospects, and business partners. The items on the PCI compliance checklist should be used in conjunction with the recommended security best practices to maximize your data protection strategies.

At phoenixNAP, we know the importance of security and trust. We offer products to help you build a PCI DSS compliant platform for your company and protect your confidential data.