Skip to content

Merchant Monitoring Resource Center

Why Mitigating Risk Includes Meeting PCI DSS Compliance Requirements

There are many elements to compliance for a payments company, one of which is Payment Card Industry Data Security Standards (PCI DSS). Read more to understand why PCI DSS is an important card brand requirement for reducing fraud, and what PCI DSS compliance requirements are.

What Are PCI DSS Compliance Requirements?

PCI DSS is a standard for information security focused on protecting cardholder data. The PCI Security Standards Council's global requirements apply to all merchants and processors who want to accept credit card payments. The standards are intended to reduce the chances of data breaches, which could lead to fraudulent activity.

According to the Council, PCI DSS security standards include the following:

  1. Ensure adequate firewall configurations exist to protect cardholder data.
  2. Refrain from using default or vendor-supplied security parameters or passwords.
  3. Protect stored data.
  4. Encrypt cardholder data in all public or open network environments.
  5. Use and update anti-virus software on a regular basis.
  6. Confirm systems and applications are secure.
  7. Provide access to cardholder data on a need-to-know basis.
  8. Give each person with computer access a unique ID.
  9. Place physical restrictions on cardholder data.
  10. Monitor every person’s access to cardholder data and network resources.
  11. Enact regular testing of security systems and protocols.
  12. Put in place policies that directly address information security.

Reducing the risk of cardholder information theft is important because of the risk of payment fraud. Sometimes cardholder information is sold on the dark web; other times someone may use the information directly to make unauthorized transactions or purchases. Sensitive information can give fraudsters the tools and means to empty a person’s bank account.

PCI DSS Compliance Is Especially Important — and Complex — for Large Organizations

The PCI Security Standards Council created additional guidance for large merchants and organizations that store, process, or transmit cardholder data.

While all organizations are required to rigorously and continuously assess, repair, and report, larger organizations may have greater challenges because of the complexity, scale, and reach of their operations.

According to the PCI DSS for Large Organizations, these companies must adhere to local laws, regulations, and standards in all jurisdictions where they have operations.

The process for mitigating risk in large organizations includes:

  • Asset management
  • System hardening
  • Access control
  • Vulnerability assessment
  • And patch management

PCI DSS compliance ensures merchants and payment service providers create secure environments for card processing transactions. Cardholders rely on all entities within the processing chain to keep their payment information safe.