Last week I wrote an article detailing how to comply with the first two PCI DSS Standards. In this article, I will show what is involved in complying with the two requirements in the “Protect Cardholder Data” standard.

Requirement 3: Protect stored cardholder data
Requirement 4: Encrypt transmission of cardholder data across open, public networks

We have provided a secure network to collect and store our customer’s information. Now, we need to turn our attention to the data itself. To fulfill requirement 3, we need to come up with a policy detailing how we will store card holder data. This sounds easy enough, just make a few decisions and stick with them. However, this is actually a bit more complicated as the PCI-DSS FAQ explains. There are 20 different criteria to meet. While I suggest reading the linked FAQ some highlights are:

• 3.1 Keep cardholder data storage to a minimum.
• 3.2 Do not store sensitive authentication data after authorization (even if encrypted).
• 3.2.3 Do not store the personal identification number (PIN) or the encrypted PIN block.
• 3.3 Mask PAN (Personal Account Number) when displayed (the first six and last four digits are the maximum number of digits to be displayed).

Continue reading…

PCI DSS (Payment Card Industry Data Security Standard) is a security standard that applies to companies handling credit card numbers. The PCI level of enforcement differs based on the volume of transactions that a company handles. The lowest level is level 4, which applies to eCommerce sites processing less than 20,000 transactions annually. The highest and most stringent is PCI level 1, which applies to merchants processing over 6 million transactions a year. Ultimately, the goal is to increase security for all Web sites accepting payment via credit card. 2Checkout completes an annual audit for PCI compliance, which we take pride in maintaining consistently.

Level 4 merchants are typically subject to completing an annual self-assessment questionaire, which contains approximately 220 questions. Furthermore, annual external quarterly scans are a common requirement. The exact requirements are typically set by the merchants’ bank.

Smaller eCommerce sites that have credit cards compromised can be fined between $20 and $30 dollars per each stolen credit card up to $500,000 dollars. Additionally, depending on the size of the breach, the site could be required to hiring an external forensic investigator. The cost of an external audit typically begins around $10,000.

A report published recently by ECommerce-Guide.com identifies increased scrutiny that PCI Level 4 eCommerce sites are being subjected to.

The cost of becoming PCI compliant can be substantial. Especially if your Web site was not initially designed with security being a focus. The requirements cover all aspects of business: technology utilized and how it is implemented as well as business processes and workflow.

Becoming a 2Checkout supplier can quickly enable PCI compliance for your eCommerce site, while keeping the cost of doing business lower in the long term. A 2Checkout supplier will not be required to complete any PCI compliance forms. No changes to your servers or business processes will be required! This is one of the many areas where 2Checkout provides more value to you, our customers and suppliers.

Article was updated on 9/21/2009 clarifying requirements for “PCI Questionnaire A.”

Article was updated on 11/9/2009 to eliminate possible ambiguity in supplier obligations.

2CO meets PCI requirements so you don’t have to!

When considering the best way to sell your products over the internet, one of the most important aspects to look at is the security of customer data. Credit card companies require all merchants to follow extensive security guidelines, called the PCI DSS, which describe every aspect of how the customer’s information is handled. Meeting the requirements set forth in the PCI DSS can be an expensive and time consuming endeavor. 2Checkout takes on the responsibilities of PCI DSS compliance for our suppliers, saving you time and money.

Continue reading…