PCI Compliance ServicEs

The PCI DSS is a set of best practice security measures to ensure the protection of payment card account data (customers’ cardholder data and sensitive authentication data) and the security of any environment where payment card account data is accepted, processed, stored, and/or transmitted.  Compliance with the PCI DSS involves implementing, operating, and maintaining those security measures from the standard that are applicable to your business’s cardholder data environment(s) to keep systems and payment card account data secure and to help prevent, detect, and respond to data breaches.

The PCI DSS itself isn’t about certification; rather, it is about following (complying with) the security measures and controls contained in the standard. The PCI DSS applies to all organizations involved in payment card processing (including merchants, processors, acquirers, issuers, and service providers), as well as to all other organizations that store, process, or transmit (or could impact the security of) payment card account data.

Some organizations may be required to validate their compliance with the PCI DSS.  Compliance validation is the annual process of performing an assessment of the organization’s PCI DSS compliance (either through self-assessment or as a formal assessment undertaken by a PCI Qualified Security Assessor), completing the applicable assessment reporting document and associated PCI DSS Attestation of Compliance, and submitting those validation documents (including an Approved Scanning Vendor (ASV) external vulnerability scan report, if required) to the relevant compliance accepting entity.  Validation is an annual, point-in-time declaration of the organization’s compliance with the PCI DSS.  

Whether an organization is in scope for and subject to the PCI DSS requirement to validate their compliance is at the discretion of those organizations that manage PCI DSS compliance programs, such as the payment card brands and acquiring banks.  Validation requirements may be specified in the payment card brands’ rules or other standards and differ for certain types of organizations or are based on the volume of transactions processed.

Protecting payment card account data from unauthorized use, exposure, and potential fraud is key in delivering the trust expected by customers and partners. If customers or partners find out security is lax for example, as a result of a data breach or is not up to the standard expected, they might take their business elsewhere.  
 
The potential consequences and costs of non-compliance with the PCI DSS include:
‍
For merchants, the potential for non-compliance charges levied by acquirer(s) / merchant services provider.For service providers, the possibility of not meeting contractual obligations.
May be in breach of personal data protection regulations, such as the EU GDPR.
‍If a data breach occurs, costs can be encountered in several areas:
‍
Notification – serving notice to data subjects, determining regulatory requirements, and communicating with regulators.Post-breach response: communicating with and supporting affected customers, recompense and credit monitoring/ID protection costs, legal expenses, and regulatory fines.Detection and escalation – forensics/investigations, crisis management, boards/executive communications.
Revenue and lost opportunities – service disruption and downtime, customer attrition, and reputation/goodwill losses.
Post-breach recovery, remediation, and compliance assessment costs.
Penalties levied by the payment card brands.
Penalties levied by data protection regulators for breach of personal data.

Achieving (and maintaining) PCI DSS compliance carries a range of up-front and ongoing costs.  The cost and effort will vary depending on an organization’s specific situation.  What you can expect to pay depends on variables such as:.  
‍
The size, location, and nature of the organization.The number of card-based transactions processed (or support the processing of) annually.
How process card-based payments are captured (i.e., in-person, via mail order or telephone, or online) – if a merchant business.
The services offered, the organization’s role in payment card processing, and the potential to impact the security of account data - if the organization is a third-party service provider.The complexitu of the organization's network, systems, and security setup that supports the payment card acceptance and/or processing.
‍Potential cost areas include:
‍‍
Annual PCI DSS Assessment Security Testing Network, hardware, software, and technology spend
Implementation and remediation
Documentation and training
Resource/Time commitments