PCI Compliance: 12 Requirements You Should Never Ignore

Ignoring PCI compliance could cost you more than you think.

Mo’ money, more problems? If you work in an industry that handles credit card data, you must use security compliance tools. Otherwise, you could find yourself in a lot of trouble when you ignore PCI compliance. But what exactly is PCI compliance, and who needs to worry about it? We’ve put together your guide to answer all the burning questions you have. 

Before PCI was formed in 2006, there was no clear industry standard that all credit card companies had to follow, which is a problem for any company that deals with big data.

In 2006, Visa, MasterCard, Discover, and AMEX established the PCI Security Standards Council (PCI SSS) to help regulate the credit card industry and establish clear operating guidelines for how consumer credit card information should be handled.

Before we go any further, let’s dig into some quick definitions to help keep things straight:

• PCI: The Payment Card Industry, also known as your major credit card companies
• PCI SSS: The Payment Card Industry Security Standards Council that is in charge of creating PCI compliance regulations
• DSS: Data Security Standards, or the regulations being placed on anyone who has to follow PCI compliance
• PCI DSS: Payment Card Industry Data Security Standards, the more common way of referring to the standards set for anyone who has to follow PCI compliance

As with many compliance programs, PCI has seen several changes over the years. The most recent version is known as PCI DSS 3.2. It was first introduced in 2016 and officially replaced the old version of PCI on February 1, 2018.

How to comply with PCI: 12 requirements

The requirements that the PCI SSC set forth for vendors are known as the PCI DSS. They are comprised of 12 compliance points, and anyone who wants to stay compliant with PCI standards must follow them.

It’s not enough to just say you’re following PCI compliance. Every company is required to complete an annual PCI compliance validation check. This shows that you’re following the requirements as they are written and not jeopardizing any client data.

Completing a PCI compliance validation involves several steps. Lucky for you, we’ve put together a handy PCI compliance validation checklist to make it easier.

Should you stay PCI compliant?

Yes! Any merchant that processes, stores, or transmits credit card data must be PCI compliant.

All of the major credit card companies agreed that merchants and service providers who handle consumer credit card information must prove that they are appropriately protecting that information.

This standard applies to all businesses, regardless of size. If you run a business and you handle credit card information from customers, you must adhere to PCI compliance regulations. It might be time to hire a chief compliance officer. Every business falls into a PCI compliance level, and each level requires a different standard of compliance difficulty.

There are four PCI compliance levels: Level 1 is reserved for large enterprise corporations and has the most rigorous PCI compliance requirements. Nearly all small to medium-sized businesses will be classified in the lower two levels. This does not mean that they can take it easier than larger enterprise corporations. Everyone is equally responsible for keeping PCI compliance in the eyes of the PCI Security Standards Council.

But wait, does that mean that independent sellers need to create their own PCI compliance program?

Probably not. Most independent sellers use a vendor like Square Payments, Etsy, or PayPal to conduct their business. These are known as payment gateway software solutions. These platforms are already held to PCI compliance standards, which means your sales are covered when you use their platform.

Who oversees PCI compliance?

There are two regulatory bodies that oversee PCI compliance:

• The PCI Security Standards Council (PCI SSC) which designs the specific Data Security Standards (DSS) that are required of all merchants regardless of revenue and credit card transaction volumes.
• The credit card companies Visa, MasterCard, Discover, and AMEX, who enforce consequences for PCI compliance violations

Basically, the PCI SCC is in charge of designing and implementing the standards for compliance. Any company that doesn’t adhere to them will have to deal with repercussions as set by the credit card companies themselves.

Why could ignoring PCI compliance cost you?

A common misconception about PCI compliance is that it’s required by law. It’s not.

You might think that means that PCI compliance is optional, but that’s not the case. Because all of the major credit card companies have decided PCI compliance is required, it’s almost impossible to operate a business and ignore it.

Don’t break the bank by breaking the rules

PCI compliance violation fines can range anywhere from $5,000 to $100,000 a month depending on the severity of the breach. You can’t ignore PCI compliance away. Either you adhere to the requirements or continue to get slapped with hefty fines and stricter rules. Instead, find the right way to stay compliant.

Trying to ensure compliance across teams? Check out the top regulatory change management software to spot non-compliance and implement regulatory changes.

This article was originally published in 2019. It has been updated with new information.