[vc_row full_width=”stretch_row” bg_type=”image” parallax_style=”vcpb-vz-jquery” bg_image_new=”id^934|url^https://digi-desk.co.uk/wp-content/uploads/2021/01/abstract-digital-background.jpg|caption^null|alt^null|title^abstract-digital-background|description^null”][vc_column css=”.vc_custom_1614849930474{padding-top: 110px !important;padding-bottom: 140px !important;}”][ultimate_heading main_heading=”The 12 Requirements Of Compliance” main_heading_color=”#ffffff” sub_heading_color=”#ffffff” alignment=”left” main_heading_font_family=”font_family:Montserrat|font_call:Montserrat|variant:800″ main_heading_style=”font-weight:800;” main_heading_font_size=”desktop:60px;tablet_portrait:38px;mobile:38px;” sub_heading_font_family=”font_family:Montserrat|font_call:Montserrat|variant:800″ sub_heading_style=”font-weight:800;” sub_heading_font_size=”desktop:23px;” main_heading_line_height=”tablet_portrait:39px;mobile:39px;”][/ultimate_heading][/vc_column][/vc_row][vc_row full_width=”stretch_row”][vc_column][row_separator scale=”0.5″ color1=”” color2=””][ultimate_heading main_heading=”The 12 Requirements Of PCI DSS Compliance” heading_tag=”h3″ main_heading_color=”#000000″ alignment=”left” sub_heading_line_height=”desktop:24px;” main_heading_font_family=”font_family:Montserrat|font_call:Montserrat|variant:800″ main_heading_style=”font-weight:800;” main_heading_font_size=”desktop:35px;” sub_heading_font_family=”font_family:Quicksand|font_call:Quicksand” margin_design_tab_text=””]Secure PCI DSS certified payments are a feature of DigiDesk’s comprehensive cloud contact centre solution, but there’s a lot more to compliancy than you might think…
Achieving PCI DSS compliance ensures your organisation plays their part in reducing instances of card fraud. When processing card transactions or dealing with a customer’s financial details, you must be wholly compliant, as the repercussions of being anything but, can be significant!
There are four tiers, and twelve requirements for achieving PCI DSS compliance. Level 1 – the highest tier – is for organisations turning over the largest number of card transactions per annum, or those with a history of data breaches, and is subject to yearly on-site audits and network scans. Tier 4 – the lowest level – is suitable for entities processing up to 20,000 card transactions per annum, and compliance is subject to a self-assessment questionnaire. However, every organisation looking to achieve compliance is directed to the key framework of twelve requirements, no matter which tier they operate under.[/ultimate_heading][vc_empty_space height=”15px”][ultimate_heading main_heading=”1. Protect your system with firewalls” heading_tag=”h4″ alignment=”left” main_heading_font_family=”font_family:Montserrat|font_call:Montserrat|variant:800″ main_heading_style=”font-weight:800;” main_heading_font_size=”desktop:23px;” sub_heading_line_height=”desktop:24px;” sub_heading_font_family=”font_family:Quicksand|font_call:Quicksand”]An expertly configured and professionally maintained firewall provides effective protection for your system and, in return, your customers’ data. Both hardware and software firewalls are required. Hardware firewalls deliver robust network security, whereas software firewalls defend against threats from employee mobile devices or emails, etc.[/ultimate_heading][vc_empty_space height=”25px”][ultimate_heading main_heading=”2. Configure passwords and settings…” heading_tag=”h4″ alignment=”left” main_heading_font_family=”font_family:Montserrat|font_call:Montserrat|variant:800″ main_heading_style=”font-weight:800;” main_heading_font_size=”desktop:23px;” sub_heading_line_height=”desktop:24px;” sub_heading_font_family=”font_family:Quicksand|font_call:Quicksand”]Inventory and configure all passwords and settings, especially for routers and third-party software that often ship with factory default settings & access codes, to ensure they are unique and not set to the defaults. This must be applied to every system and device used throughout your organisation.[/ultimate_heading][vc_empty_space height=”25px”][ultimate_heading main_heading=”3. Protect stored cardholder data…” heading_tag=”h4″ alignment=”left” main_heading_font_family=”font_family:Montserrat|font_call:Montserrat|variant:800″ main_heading_style=”font-weight:800;” main_heading_font_size=”desktop:23px;” sub_heading_line_height=”desktop:24px;” sub_heading_font_family=”font_family:Quicksand|font_call:Quicksand”]Ensure all card data you store is encrypted. You will be asked to present a flow diagram outlining how card data is handled by your organisation. Software such as PANscan or Pllscan can help you track card data for secure encryption, or deletion where necessary.[/ultimate_heading][vc_empty_space height=”25px”][ultimate_heading main_heading=”4. Encrypt transmission of cardholder data across open, public network…” heading_tag=”h4″ alignment=”left” main_heading_font_family=”font_family:Montserrat|font_call:Montserrat|variant:800″ main_heading_style=”font-weight:800;” main_heading_font_size=”desktop:23px;” sub_heading_line_height=”desktop:24px;” sub_heading_font_family=”font_family:Quicksand|font_call:Quicksand”]Card data must be encrypted as it’s transferred across public networks. Tools like PCI DSS Encryption Key Management can help you achieve optimal security.[/ultimate_heading][vc_empty_space height=”25px”][ultimate_heading main_heading=”5. Use and regularly update anti-virus software…” heading_tag=”h4″ main_heading_color=”#000000″ alignment=”left” main_heading_font_family=”font_family:Montserrat|font_call:Montserrat|variant:800″ main_heading_style=”font-weight:800;” main_heading_font_size=”desktop:23px;” sub_heading_font_family=”font_family:Quicksand|font_call:Quicksand” sub_heading_line_height=”desktop:24px;”]You must install, maintain and regularly update anti-virus software across all systems and devices susceptible to malware. The ability to demonstrate an ongoing commitment to your security is part of achieving compliance, so it’s important to adopt a proactive approach and remain vigilant where new malware threats are concerned.[/ultimate_heading][vc_empty_space height=”25px”][ultimate_heading main_heading=”6. Regularly update and patch systems…” heading_tag=”h4″ main_heading_color=”#000000″ alignment=”left” main_heading_font_family=”font_family:Montserrat|font_call:Montserrat|variant:800″ main_heading_style=”font-weight:800;” main_heading_font_size=”desktop:23px;” sub_heading_font_family=”font_family:Quicksand|font_call:Quicksand”]You must remain attentive to any potentially dangerous holes in your cyber security, so they can be fixed as soon as possible. Regular anti-virus updates will help to keep you protected, and your security software vendor should keep you apprised of any available patches and/or upgrades as and when they’re available.[/ultimate_heading][vc_empty_space height=”25px”][ultimate_heading main_heading=”7. Restrict access to cardholder data to business need-to-know…” heading_tag=”h4″ main_heading_color=”#000000″ alignment=”left” main_heading_font_family=”font_family:Montserrat|font_call:Montserrat|variant:800″ main_heading_style=”font-weight:800;” main_heading_font_size=”desktop:23px;” sub_heading_font_family=”font_family:Quicksand|font_call:Quicksand”]Implement a role-based access control (RBAC) system, to facilitate access to card data and systems on a need-to-know basis. You must configure administrator and user accounts, to prevent exposure of sensitive data to those who don’t require it.[/ultimate_heading][vc_empty_space height=”25px”][ultimate_heading main_heading=”8. Assign a unique ID to each person with computer access…” heading_tag=”h4″ main_heading_color=”#000000″ alignment=”left” main_heading_font_family=”font_family:Montserrat|font_call:Montserrat|variant:800″ main_heading_style=”font-weight:800;” main_heading_font_size=”desktop:23px;” sub_heading_font_family=”font_family:Quicksand|font_call:Quicksand”]User IDs and passwords must be sufficiently unique & complex. Although, system security should not solely rely on the complexity of a single password. No password should be deemed uncrackable, which is why all remote access to in-scope systems requires multi-factor authentication, as of 01/02/2018[/ultimate_heading][vc_empty_space height=”25px”][ultimate_heading main_heading=”9. Restrict physical access to workplace and cardholder data…” heading_tag=”h4″ main_heading_color=”#000000″ alignment=”left” main_heading_font_family=”font_family:Montserrat|font_call:Montserrat|variant:800″ main_heading_style=”font-weight:800;” main_heading_font_size=”desktop:23px;” sub_heading_font_family=”font_family:Quicksand|font_call:Quicksand”]You can not store sensitive information, such as payment card data, out in the open. In fact, you must physically limit access to areas with cardholder data, as well as document the following:
- Who has access to secure environments and why they need this access
- What, when, where, and why devices are used
- A list of authorized device users
- Locations where the device is and is not allowed
- What applications can be accessed on the device
[/ultimate_heading][ultimate_heading main_heading=”10. Implement logging and log management…” heading_tag=”h4″ main_heading_color=”#000000″ alignment=”left” main_heading_font_family=”font_family:Montserrat|font_call:Montserrat|variant:800″ main_heading_style=”font-weight:800;” main_heading_font_size=”desktop:23px;” sub_heading_font_family=”font_family:Quicksand|font_call:Quicksand”]Failure to comply with this requirement has resulted in a significant number of data breaches. You must monitor any flagged incidents and deal with them quickly! Incident logs should be subject to review at least once daily, and you must demonstrate an effective, robust process for dealing with any potential anomalies.[/ultimate_heading][vc_empty_space height=”25px”][ultimate_heading main_heading=”11. Conduct vulnerability scans and penetration tests…” heading_tag=”h4″ main_heading_color=”#000000″ alignment=”left” main_heading_font_family=”font_family:Montserrat|font_call:Montserrat|variant:800″ main_heading_style=”font-weight:800;” main_heading_font_size=”desktop:23px;” sub_heading_font_family=”font_family:Quicksand|font_call:Quicksand”]Vulnerability scans and penetration tests are imperative, and can highlight whether patches & upgrades have been successful. The frequency with which you are asked to perform these tests will depend on the tier your organisation must adhere to.[/ultimate_heading][vc_empty_space height=”25px”][ultimate_heading main_heading=”12. Documentation and risk assessments…” heading_tag=”h4″ main_heading_color=”#000000″ alignment=”left” main_heading_font_family=”font_family:Montserrat|font_call:Montserrat|variant:800″ main_heading_style=”font-weight:800;” main_heading_font_size=”desktop:23px;” sub_heading_font_family=”font_family:Quicksand|font_call:Quicksand”]You must keep documentation, policies, procedures, and evidence relating to your company’s security practices. You must also undertake an annual, formal risk assessment to identify any critical assets, threats, and vulnerabilities to help improve your ongoing security practices.[/ultimate_heading][vc_empty_space height=”25px”][ultimate_heading main_heading_color=”#000000″ alignment=”left” main_heading_font_family=”font_family:Montserrat|font_call:Montserrat|variant:800″ main_heading_style=”font-weight:800;” main_heading_font_size=”desktop:30px;” sub_heading_font_family=”font_family:Quicksand|font_call:Quicksand”]For more information around PCI DSS compliance, or to discuss our PCI DSS certified payments solution, get in touch with the team at DigiDesk. We look forward to hearing from you.[/ultimate_heading][vc_separator color=”custom” accent_color=”rgba(0,0,0,0.2)” css=”.vc_custom_1612282685304{margin-top: 20px !important;}”][/vc_column][/vc_row]
