Protect customer payment data and
protect your business from data breaches
Payment Card Industry – Data Security Standard popularly known as PCI -DSS is the security standard laid out by the PCI Security Standards Council.
The standard outlines the technical and operational requirements required to protect cardholder data.
About PCI – DSS
The PCI DSS standard consists of 12 requirements categorized to achieve 6 domains.
| Domain | PCI – DSS Requirements |
|---|---|
| Build and Maintain a Secure Network and Systems | 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor-supplied defaults for system passwords and other security parameters |
| Protect Cardholder Data | 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open, public networks |
| Maintain a Vulnerability Management Program | 5. Protect all systems against malware and regularly update antivirus software or programs 6. Develop and maintain secure systems and applications |
| Implement Strong Access Control Measures | 7. Restrict access to cardholder data by business need to know 8. Identify and authenticate access to system components 9. Restrict physical access to cardholder data |
| Regularly Monitor and Test Networks | 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes |
| Maintain an Information Security Policy | 12. Maintain a policy that addresses information security for all personnel |
The PCI DSS standards applies to everyone in the payment card service chain - to all entities that store, process or transmit cardholder data.
In PCI terms - the standard applies to Merchants and Service Providers.
Simply put, if you accept or process payment cards – PCI DSS is a mandatory compliance requirement.
Having PCI DSS Certification saves businesses from both monetary and reputational damages. This is because all the 12 requirements composed by PCI SSC provides trust to customers that your business is safe to operate and associate with.
The compliance certification efficiently keeps breaches at bay and saves an organization from multiple impediments. According to cybersecurity and payment card industry experts, it is advisable to invest in PCI best industry practices and assure adherence. The added need for doing a yearly recertification assessment allows a business to be at par with evolving cybersecurity threats.
Our Approach to PCI – DSS Certification
Our team of Qualified Security Assessors (QSAs) bring to the table their vast experience on payment card domain across industry verticals to make compliance easy for you. At Crossbow Labs, our methodology is our biggest asset when providing PCI DSS consulting and implementation support.
We can Support You with
PCI-DSS is one of our favourite information security standards in the offering. Not only because it is one among the mature information security standards out there, but also because it is evolving, community centric and its free for anyone to follow.
We can get you started on a roadmap towards successful certification and sustained compliance. Get Started
If you are already on your compliance path or looking to renew your certification, we can assist you in the last leg of your success – a PCI – DSS certificate.
We do a quick reconnaissance of your set up and get started on the final audit to get you certified. Get Started
Our tailor-made PCI DSS training program can help you get started on a training program to cater to the roles and responsibilities of the key players in your compliance roadmap. Our training program is designed to
- Upgrade the security culture
- Lower the likelihood of data loss, and
- Make PCI DSS requirements easy to comprehend and implement. Know More
We also offer support services to help address all the technical roadblocks towards PCI DSS compliance.
Payment Card Data Finder
Log Management Set Up
Policy & Procedure Guidance
Resource Centrale
Our Perspective
PCI Security Standards Council addresses 2 types of entities that deal with cardholder data, Merchant and service provider in the Data security standard. There are certain requirements in the PCI DSS which has to be met only by Service provider.
Further, The council has created Self attestation questionnaires (SAQs) for all those merchants and service providers whose risk profile is not significant and can go for these SAQs as requested by acquiring banks or payment brands.
Currently there are 8 PCI FAQs which are created for various types of mechants.
For detailed explanation on FAQs, read our blog on “ What is the Right SAQ for You?”
A Qualified Security Assessor (QSA) will perform an audit of your operating environment and will evaluate It against the 12 requirements and 300 sub requirements mentioned in the PCI DSS standard.
On successful evaluation, the QSA will award your organisation a PCI- DSS Compliance Certificate. The Certificate will be your badge of honor recognizing the efforts taken towards prioritizing security.