PCI compliance
What is PCI DSS compliance?
PCI DSS compliance (Payment Card Industry Data Security Standard compliance) is adherence to a set of international security standards designed to protect cardholder data. Developed by the PCI Security Standards Council (PCI SSC), which is supported by major card networks like Visa, Mastercard, and American Express, PCI DSS applies to any organisation that processes, transmits, or stores credit and debit card information. In the UK, just like elsewhere, any business accepting card payments must meet these requirements to reduce the risk of data breaches and card fraud.
How do organisations protect cardholder data?
To meet PCI DSS requirements, businesses must:
- Maintain a secure network, using firewalls and other network security tools to protect all cardholder data.
- Implement strong access control, ensuring only authorised personnel can access cardholder data.
- Encrypt all cardholder data that’s transmitted across public networks.
- Test their security processes regularly, such as performing vulnerability scans and penetration tests.
- Maintain up-to-date anti-virus and anti-malware software, applying patches as they become available.
- Implement a formal information security policy to guide everyone who handles data.
