PCI DSS Compliance Guide [Simple Explanation]

PCI DSS, or the Payment Card Industry Security Standard, is a set of security requirements that are designed to protect and safely process cardholder data. This global standard is used widely, as credit cards are part of transactions and many online platforms that facilitate payments. That means merchants and various service providers, including iDenfy, are required to comply with PCI DSS as a way to safely process and accept credit and debit card info/payments. 

In brief:

• Since a wide portion of online platforms are monetized and handle debit or credit card payments, the PCI DSS compliance requirement should be widely adopted. 
• PCI DSS isn’t a one-and-done matter, as it requires monitoring and annual validation to ensure compliance. 
• There are 12 key PCI DSS requirements that help companies shape their own compliance measures in-house. 

But what exactly is required for compliance, and which PCI DSS requirements are most important to focus on? I’ll explain below.

What is PCI DSS?

The Payment Card Industry Data Security Standard (PCI DSS) is a global cardholder data security standard launched in 2004 by major credit card firms (AMEX, Visa, Mastercard, JCB and Discover). 

It protects sensitive information and helps companies working with payments to securely store and transmit cardholder details, such as the user’s:

• Expiration dates
• Service codes and names
• Primary account numbers (PANs)

This is required throughout the whole lifecycle and business relationship on the platform. That means companies need to ensure ongoing monitoring and periodic evaluation of current PCI DSS security practices to identify and prevent potential security risks. Additionally, merchants and regulated service providers are required to comply with annual reporting to a Cardholder Data Environment (CDE). 

Which Platforms are Required to Comply with PCI DSS?

Any service provider, system, or platform is required to comply with PCI DSS requirements if it stores, processes, or transmits cardholder data and, alternatively, can affect the general security of the cardholder data environment (CDE). 

Some common examples include:

• E-commerce merchants that accept card payments
• Payment gateways (or APIs that transmit payment information)
• Payment processing platforms that handle cardholder data
• Cloud infrastructure and platforms that support card payments
• POS systems, such as a Shopify POS, used for in-person transactions
• Other third-party service providers 

That’s why the concrete steps and PCI DSS requirements depend on the organization and its use case, linked to how and why it needs to handle card information or payments. 

What is the Goal of the Payment Card Industry Security Standard (PCI DSS)?

Under PCI DSS, platforms are required to protect sensitive cardholder data and reduce payment fraud. 

Additionally, PCI DSS compliance measures aim to help:

• Control access to sensitive payment details
• Secure payment systems against cyberattacks
• Document and maintain secure policies for handling payment card info
• Ensure transparent monitoring and testing controls to identify potential security gaps

Related: Top 5 Merchant Fraud Types & How to Avoid Them

Who Manages PCI DSS Compliance?

The PCI Security Standards Council (PCI SSC), an organization and independent body founded by major credit card companies, is responsible for managing PCI DSS compliance. It develops security standards that companies are required to adopt. As a result, individual firms are responsible for meeting these standards. 

Internal teams often appoint a Qualified Security Assessor (QSA) for that, which is an official method approved by PCI SSC, similar to how Anti-Money Laundering (AML) programs have a responsible appointed AML officer in a firm. 

How to Define PCI DSS Scope?

The first thing to do when you start briefing your PCI DSS compliance checklist is to assess your scope: identify the processes, systems and people who are linked to cardholder data and the whole environment that requires PCI DSS measures. 

Practical ways to achieve this include:

• Reviewing your third parties and their processes on cardholder data handling
• Mapping out payment information data flows and the stages they go through (storage, processing, transmission, or deletion)
• Separating the CDE from systems or processes that don’t require access to cardholder data

This helps reduce the scope and the overall complexity of PCI DSS compliance because you have clear policies that reduce the risk of a potential breach. 

12 Requirements of PCI DSS

PCI DSS requirements consist of rules and guidance points that obliged companies need to use internally in order to ensure compliance. 

All 12 points cover the technical and operational aspects of PCI DSS, pointing out that companies need to:

1. Install and maintain network security controls (to protect the cardholder data environment)
2. Apply secure configurations (to prevent the use of default passwords and settings)
3. Protect stored account data (to minimize chances of unauthorized access or disclosure)
4. Protect cardholder data during transmission (especially over open, public networks)
5. Protect systems and networks from malicious software (to keep security mechanisms up to date)
6. Develop and maintain secure systems and software (including vulnerability management and secure development practices)
7. Restrict access to system components (might differ due to industry-specifics and particular use case in terms of access to cardholder data)
8. Identify users and authenticate access (using appropriate authentication controls, such as MFA or strong password policies) 
9. Restrict physical access to cardholder data and related systems
10. Log and monitor access to system components and cardholder data
11. Regularly test security systems and processes (to identify vulnerabilities and security weaknesses)
12. Support information security with internal policies and programs (for example, special in-house policies and risk management procedures)

Related: What is an AML Risk Assessment? [With Examples]

What are the Benefits of PCI DSS Compliance?

Apart from the obvious one, the benefit of secure payments and protected cardholder information, PCI DSS compliance helps companies ensure:

Better Detection of Risks

If implemented correctly, proper PCI DSS measures help identify gaps in current procedures, helping ensure a safer environment for data retention. Companies can then work on potential vulnerabilities and ensure that issues like misuse, unauthorized access and account takeover (ATO) fraud, for example, popular on e-commerce marketplaces, don’t happen. This also helps reduce the impact of related risks like payment data breaches. 

Improved Trust Among Partners and Customers

Business partners are more likely to invest in or choose you as a payment partner once you have the proof and demonstrate complete compliance, including with PCI DSS requirements. Non-compliance results in fines, even if it’s not on your part. A compliant business is a business that people want to work with and give out sensitive information.

Severe compliance breaches can lead to a lost business license and potential risks to cardholder data if improper safeguards are used. Naturally, other consequences, like adverse media, follow. 

Consistent Security and Auditing Measures

Once you have a clear framework for PCI DSS, you can follow a structured approach, helping you to monitor, test and document your existing compliance controls. The 12-point checklist helps design your own internal workflows for that. A vendor specializing in PCI DSS-compliant solutions can also provide additional support with cardholder security processes. 

How to Handle Credit Card Information in Line With PCI DSS?

Simple tips like avoiding unnecessary cardholder data storage or using encryption for data protection help. The specific measures depend on your use case, as PCI DSS is often a component of a bigger fraud prevention system. If that’s the case, you need to look for a solution that integrates well with other measures. 

For example, in iGaming, duplicate accounts and the repeated use of the same credit card information are used as a way to bypass Know Your Customer (KYC) controls, especially if the user is blocklisted or wants to create a new account as a way to conduct bonus abuse. To avoid that, with scale in mind (especially if large volumes of transactions and users registering daily are common on your platform), you need a solution that would verify payment card details automatically. 

Tools like Bank Card Verification, which are PCI DSS-approved and compliant, do that while ensuring security and without storing CVV data or the full card number. That means the system cross-matches the last four digits of the card and either approves the user or denies their attempt to access certain services. It’s quick and easy for the user, keeping your platform oriented to conversions as well. 

Related: How to Implement a KYC API [3 Steps to Get Started]

Does iDenfy Have PCI DSS Certification?

Yes, iDenfy has PCI DSS certification. Our Bank Card Verification software is PCI-compliant and designed to quickly verify cardholder data without storing it. You can either use it with other KYC measures, such as government-issued ID checks and liveness checks, or implement it as a single measure in your onboarding flow. 

The end-user is required to capture a photo of their credit or debit card, and the system does the rest, meaning manual input is minimal. This allows you to confirm the legitimacy of the card without the user getting scared and dropping off or not trusting the service enough to provide their card altogether. 

How Can I Validate PCI DSS Compliance?

The final decision on how you validate PCI DSS compliance depends on your company and payment environment. 

It’s also worth to: 

• Assess your security controls and check if they live up to the current PCI DSS requirements (a Self-Assessment Questionnaire (SAQ) via PCI Security Standards Council helps) 
• Work with a Qualified Security Assessor (QSA) and conduct a proper audit of your PCI DSS compliance system, checking if all measures are working appropriately.

Final Checklist for PCI DSS Compliance

Ultimately, PCI DSS is only a framework. While it’s meant to help you protect cardholder data and ensure secure payments, you and your company are responsible for executing and implementing concrete controls. More importantly, maintaining integrated tools and systems can be a big task, especially when using multiple fraud prevention and compliance services that need to work together. 

You also need to demonstrate that these systems are consistently maintained and kept up to date. Testing and auditing help, as well as standard measures like documentation and documented systems for third-party providers and whether certain people within the organization need to access cardholder data in the first place. 

I also recommend talking to iDenfy’s team and booking a demo if you want to find out how you can benefit from the new automated Bank Account Verification tool, all in line with PCI DSS compliance.