PCI DSS Cloud Compliance

What is the Payment Card Industry Data Security Standard (PCI DSS)?

The Payment Card Industry Data Security Standard (PCI DSS) is an international, comprehensive standard outlining the minimum security requirements for cardholder data. The standard is not a law, but any service provider that processes or handles payment card data must adhere to the regulation’s requirements. The top requirements include building and maintaining a secure networks system, protecting cardholder data, maintaining a vulnerability management program, implementing strong access control measures, regularly monitoring and testing networks, and maintaining an information security policy. The regulation explicitly mandates encryption of payment card data and of the communication paths the data traverses. Validation of compliance with the PCI DSS is determined by individual payment brands.

The individual payment card companies develop personalized regulations and enforce compliance of the PCI DSS for entities that process their forms of payment. The de-standardized nature of the compliance standard requires entities that process payment card information ensure understanding of and adherence to the regulations defined by each payment card brand that they process. Penalties for breaches can include fines per cardholder data compromised, suspension from processing networks, significant reputational damage, potential litigation, and loss of customer trust.

Who does it apply to?

• All companies that accept, process, store or transmit payment card information

What data are protected?

• Cardholder data
  • An individual’s Primary Account Number (PAN) alone or along with:
    • • • Cardholder’s name
        • Expiration date
        • Service code
  • Sensitive Authentication Data (i.e. CVC, CVV, PIN, etc.) must also be protected