PCI DSS is all about protecting card holder data. Prior to 2006, all of the major card brands (Visa, Mastercard, Discover, American Express and JCB) each had their own security requirements. In 2006, they decided there needed to be consistency in security requirements across the playing field. As a result, they created a group called the PCI SSC. The council was tasked with creating a single, system-wide standard that would apply to all merchants, members, and service providers globally. PCI DSS states that PCI Data Security Requirements apply to all members, merchants, and service providers that store, process, or transmit cardholder data.

Every merchant who processes, stores, or transmits cardholder data is subject to PCI DSS and must demonstrate compliance. This is a worldwide initiative.

As a merchant, you have three different options for becoming compliant. You may review these options at the top of the page. However you choose to become compliant, the process entails three steps:
‍
1. Successfully complete a self-assessment questionnaire (SAQ)
2. Complete an attestation of compliance (AOC).
3. Complete/arrange quarterly network scans (if applicable) If you do not become compliant via one of the methods suggested, please note that a monthly non-compliance fee of $29.99 will remain on your merchant account. If you have already validated, please provide your SAQ and AOC, as well as proof of passing scan, if applicable, to pci@forte.net or fax the document to (469) 342-8010. At any point, you can reach out to CSG’s customer service team to discuss your choices. Our staff can help you understand the available options and answer any additional questions about getting started.

Yes. The growth and retention solutions including Validate, Validate+, and Authenticate are available as standalone services and can be used alongside an existing payment processor. Organizations do not need to migrate their full processing relationship to beneThe PCI SSC encourages all businesses that store, process or transmit payment account data to comply with PCI DSS. This can help reduce the brand and financial risks associated with account payment data compromises. The council does not manage compliance programs, nor do they impose any consequences for non-compliance. However, individual payment brands may have their own compliance initiatives. These may include financial or operational consequences to certain businesses that are not compliant. The payment brands may, at their discretion, fine an acquiring bank anywhere from $5,000 to $100,000 per month for PCI compliance violations. Most banks will pass this fine along until it reaches the merchant. The banks are also likely to terminate your relationship or increase transaction fees. Penalties are not openly discussed or widely publicized, but they can be truly catastrophic to a small business.

Fit from account validation, making adoption low-risk and incremental.

Especially for smaller organizations, this may seem like a lot of effort and be quite confusing. The standard provides an actionable framework for developing robust account data security processes, including preventing, detecting, and reacting to security incidents. To reduce the risk of compromise and to mitigate any impact should it occur, it is imperative that all entities storing, processing, or transmitting cardholder data be compliant. Compliance with DSS can bring major benefits to businesses of all sizes. Failure to comply can have serious and long-term negative consequences. You’ve worked hard to build your business. Secure both your success and your customers’ payment card data. Your customers depend on you to keep their information safe. Repay their trust with PCI DSS compliance.

The overall length of the process can vary. It depends on how soon an organization can resolve their non-compliance issues, the type of resolution required, and the complexity and size of the project.

Certification is good for 12 months as long as there are no major changes in the network.

There are eight versions of the SAQ. We recommend that a merchant go through the process to determine for certain which version is most appropriate for their business and cardholder data environment. ‍SAQ A
‍Card-not-present merchants (e-commerce or mail/telephone order), that have fully outsourced all cardholder data functions to PCI DSS-compliant third-party service providers, with no electronic storage, processing, or transmission of any cardholder data on the merchant’s systems or premises. Not applicable to face-to-face channels. ‍SAQ A-EP
‍E-commerce merchants who outsource all payment processing to PCI DSS-validated third parties, and who have a website(s) that doesn’t directly receive cardholder data but that can impact the security of the payment transaction. No storage, processing, or transmission of cardholder data on merchant’s systems or premises. Applicable only to e-commerce channels. ‍SAQ B
‍Merchants using only:
1. Imprint machines with no electronic cardholder data storage, and/or
2. Standalone, dial-out terminals with no electronic cardholder data storage. Not applicable to e-commerce channels. ‍SAQ B-IP
‍Merchants using only standalone, PTS-approved payment terminals with an IP connection to the payment processor with no electronic cardholder data storage. Not applicable to e-commerce channels. ‍SAQ C-VT
‍Merchants who manually enter a single transaction at a time via a keyboard into an internet-based, virtual payment terminal solution that is provided and hosted by a PCI DSS validated third-party service provider. No electronic cardholder data storage. Not applicable to e-commerce channels. ‍SAQ C
‍Merchants with payment application systems connected to the internet, no electronic cardholder data storage. Not applicable to e-commerce channels. ‍SAQ P2PE
‍Online merchants using only hardware payment terminals included in and managed via a validated, PCI SSC-listed P2PE solution, with no electronic cardholder data storage. Not applicable to e-commerce merchants.
‍
‍SAQ D
‍SAQ D for merchants: All merchants not included in descriptions for the above SAQ types.
‍SAQ D for service providers: All service providers defined by a payment brand as eligible to complete an SAQ.

The cardholder data environment is an area of a computer system network that possesses cardholder data or sensitive authentication data. It also refers to those systems and segments that directly attach or support cardholder processing, storage, or transmission.

Merchants store cardholder data for a number of reasons. Often it is helpful for recurring billing, chargebacks, and disputes, reporting or software imposition.

A vulnerability scan is a scan conducted by an approved scanning vendor. Scans rank vulnerabilities high, medium, or low, and prioritize them for patching and remediation.

All PCI scans must be conducted by a third party-compliant network security scanning vendor. A list of approved scanning vendors (ASVs) can be found at www.pcisecuritystandards.org. ASV’s will conduct scans in accordance with the defined procedures, which dictate that your customer environment cannot be penetrated, altered or impacted during the scan.

Qualified security assessors (QSAs) are authorized to perform annual audits for merchants and service providers to document compliance with PCI DSS. ASVs are authorized to perform quarterly scans to show PCI DSS compliance. Several qualified security assessors incorporate approved scanning vendors into their solution.

Scoping is the process of specifying exactly what is tested for compliance. It limits the PCI assessment to security technology and processes affecting the security of cardholder data. Merchants can leverage network segmentation to effectively isolate systems that store, process, and transmit cardholder data from the rest of the network. Controls are only required for the affected segments.

You can choose to outsource some or all of your payment processing to a service provider or software application vendor. When you outsource processing to a service provider, you will use their system; when you outsource to an application vendor, you will host their software on your own system. Outsourcing the storage, processing, or transmission of cardholder data may remove some or all of the scope from an organization as it can lift part of the compliance burden.

Just because a merchant doesn’t store cardholder data doesn’t mean it cannot be stolen. Hackers now install malicious software that monitors credit card information as it is manually keyed in or swiped. If you use a virtual terminal solution, payment application, integrated POS system, or are an e-commerce merchant, there is a moment during transmittance when card data is not encrypted. Hackers try to steal stored credit card data by exploiting that moment of weakness. In fact, 75% of breaches in 2011 occurred not from storing PCI, but during PCI transmission. Broadband connections can increase this risk.

Cybercriminals will hunt smaller, easier targets that provide them with a steady stream of data to compromise. In fact, 96% of all breaches occur within small businesses. And when it happens, it takes almost six full months on average before the fraud is detected. In one instance, a hacker wasn’t found until four years later. In that time, a merchant processing only 10 transactions a week could have fallen victim to 2,080 fraudulent transactions over a four-year period. 

Tokenization and end-to-end (aka point-to-point) encryption are great technologies for helping to reduce the number of requirements during the compliance process. However, you still need to go through the complete compliance process to avoid penalties for non-compliance.

Acquirers are allowed to set their own deadlines within reason, so they will vary from acquirer to acquirer. CSG Forte’s acquirers are cracking down on merchant PCI compliance; therefore, we are required to follow their guidelines and requirements.

No. We reviewed over a dozen QSAs and determined that the PCI vendors we have partnered with are best suited to our merchant base. There are currently over 260 QSAs worldwide that provide similar services. See the full list here: PCI Security Standards ‍Not all QSAs perform the exact same services. Many offer (and charge for) specific services, so it is in your best interest to perform due diligence when making your selection. Pricing also varies widely among QSAs, from as little as $4.95 per month to several thousand annually. We encourage our merchants to work with a QSA that best fits their needs.