Beginner’s guide to PCI DSS
What is PCI DSS?
The Payment Card Industry Data Security Standard, known as PCI DSS, is a set of requirements which explains how to protect yourself and your customers when taking payments. These are industry-wide requirements, and so any supplier that takes payments for you will expect you to take PCI DSS compliance seriously.
When you take card payments, your customers are trusting you with their valuable details and assume you’re keeping them out of the hands of fraudsters. Being PCI DSS compliant can help you do just that.
What happens if I don’t comply with PCI DSS?
If you want to take card payments, you’ll need to become and remain compliant with PCI DSS requirements.
If you can’t prove that you’re protecting your customer’s cardholder data, there could be negative consequences for both you and your customer, such as:
- Financial penalties and charges
- Damage to your business’ reputation and loss of customer trust
- Stolen funds from your customer
- Stolen identity of your customer
How do I become PCI DSS compliant?
Unfortunately, there’s no straightforward answer to this. Becoming PCI DSS compliant depends on the complexity of your payments environment, and the data security measures you already have in place. In fact, you may already be compliant and not realise!
Becoming compliant isn’t just a one-time task – you’ll need to take measures regularly to ensure you’re still complying with the rules.
Fraudsters are known to target the weakest businesses, regardless of whether they are large corporations or small local businesses. The easiest targets are those who aren’t compliant with the PCI DSS, so it makes sense that compliance will put you in a stronger position to prevent attacks.
Every business is different, but here are some examples to give you an idea of what’s involved:
Example 1: Sharon’s corner shop – a simple payment system
Set up:
Risks / threats:
Solution (PCI DSS compliant):
Example 2: Gareth’s online gift shop – a more complex system
Set up:
Risks / threats:
Solution (PCI DSS compliant):
Getting assessed for PCI DSS compliance
Again, every organisation is set up differently and therefore needs to be assessed on an individual basis. What you’ll need to do to become compliant is dependent on the kinds of security risks that your business faces.
Many small- and medium-sized businesses can prove their compliance with PCI DSS by filling out a Self-Assessment Questionnaire. At Barclaycard, we provide a portal called Data Security Manager to help our customers with this process.
You can also choose to have your payment environment assessed by an accredited Qualified Security Assessor, but this usually applies to larger organisations due to the costs and volume of transactions involved.
If you’d like more detail about PCI DSS compliance, visit our help & support page.
Are there any costs in becoming PCI DSS compliant?
There may or may not be costs involved in becoming and maintaining PCI DSS compliance, depending on the complexity of your set up. For example, the security measures you have in place at the moment and how much they need to change in order for you to become compliant.
PCI DSS costs typically fall into four categories:
For more detail on PCI DSS costs, please visit our help & support page.
Now you’re clued up on PCI DSS, you might want to read our other introductory guides on payment security: the beginner’s guide to fraud, and the beginner’s guide to chargebacks.
Or for more in-depth info on PCI DSS, visit our PCI DSS help & support page.