Last week I wrote an article detailing how to comply with the first two PCI DSS Standards. In this article, I will show what is involved in complying with the two requirements in the “Protect Cardholder Data” standard.

Requirement 3: Protect stored cardholder data
Requirement 4: Encrypt transmission of cardholder data across open, public networks

We have provided a secure network to collect and store our customer’s information. Now, we need to turn our attention to the data itself. To fulfill requirement 3, we need to come up with a policy detailing how we will store card holder data. This sounds easy enough, just make a few decisions and stick with them. However, this is actually a bit more complicated as the PCI-DSS FAQ explains. There are 20 different criteria to meet. While I suggest reading the linked FAQ some highlights are:

• 3.1 Keep cardholder data storage to a minimum.
• 3.2 Do not store sensitive authentication data after authorization (even if encrypted).
• 3.2.3 Do not store the personal identification number (PIN) or the encrypted PIN block.
• 3.3 Mask PAN (Personal Account Number) when displayed (the first six and last four digits are the maximum number of digits to be displayed).

Continue reading…

It is important to the credit card associations that the relationship between vendors and 2CO is not misrepresented. Vendors should represent 2CO as an authorized retailer or out-sourced vendor solution, not as a “credit card processor”, a “third party processor”, or “payment gateway.” Vendors do have artistic license to incorporate this depiction into the context of their site provided they do not misrepresent the relationship.

Terminology for buttons or links to 2CO that is acceptable:

“Add to Cart”
“Buy Now”
“Buy from 2CO”
“Continue ->”

Terminology for buttons or Links to 2CO that is NOT acceptable:

“Click Here to Pay”
“Process Payment Now”

Language that should be contained on your site (preferably as early in the shopping process as possible):

2Checkout.com, Inc. is an authorized retailer of <Supplier>
2Checkout.com, Inc. is an authorized retailer of goods and services provided by <Supplier>

Language that should NOT be contained on your site includes indicating 2CO is a:

“Credit Card Processor”
“A Third Party Processor”
or “A Payment Gateway”

It is important to note that failure to comply with 2CO or credit card association requirements can jeopardize your relationship with and ability to use 2CO.

Supplier may click on the following link for additional information and to determine if any updates to the requirements contained have occurred. https://www.2checkout.com/language_guidelines.html