PCI-DSS has been around for a while and is now being mandated more effectively.
https://www.pcisecuritystandards.org/
Good news is that you do not need to hire a consulting firm with a price take of $2,000-$20,000 in most instances but you have to do something about the regulations associated with processing which are coming directly mandated from the card issuers (Visa/Mastercard).
The first step is identifying what level merchant you are considered you are. Once you know then you can take the appropriate action. Note if you are a level 4 merchant you can wait for your processor to contact you with their mandated program
|
PCI Data Security Standard Compliance for Merchants |
|
Merchant Level |
Selection Criteria |
Validation Actions |
Validated By |
|
1
|
Any merchant - regardless of acceptance channel - processing more than 6,000,000 Visa transactions per year Any merchant that has suffered a hack or an attack that resulted in an account data compromise Any merchant identified by any card association as Level 1 |
Annual On-Site Security Audit and Quarterly Network Scan |
Independent Security Assessor or Internal Audit if signed by an Officer of the company Qualified Independent Scan Vendor |
|
2
|
1 million – 6 million Visa or MasterCard transactions per year |
Annual PCI Self-Assessment Questionnaire and Quarterly Network Scan |
Merchant Qualified Independent Scan Vendor |
|
3 |
20,000 – 1 million Visa or MasterCard e-commerce transactions per year |
Annual PCI Self-Assessment Questionnaire and Quarterly Network Scan |
Merchant Qualified Independent Scan Vendor |
|
4 |
Less than 20,000 Visa or MasterCard e-commerce transactions per year, and all other merchants processing up to 1 million Visa or MasterCard transactions per year |
Recommended Annual PCI Self-Assessment Questionnaire and Quarterly Network Scan |
Merchant Qualified Independent Scan Vendor Validation requirements and dates for Level 4 merchants are determined by the merchant’s acquirer. Submission of scan reports and/or questionnaires by level 4 merchants may be required. |
Merchants should expect to see a monthly fee added to their statement or may see an annual fee ranging from 100-450 to pay for this whole process or if they ignore the requirements.
KEEP IN MIND ONCE YOU COMPLETE THE REQUIREMENTS IT DOES NOT MEAN YOU ARE NOT LIABLE FOR A BREACH OF SECURITY.
