The PCI DSS (Payment Card Industry Data Security Standard) contains a set of requirements to help organisations prevent payment data breaches and payment card fraud.
But did you know that the same requirements don’t apply universally? In fact, there are four PCI compliance levels, which are determined by the number of transactions the organisation handles each year.
- Level 1: Merchants that process over 6 million card transactions annually.
- Level 2: Merchants that process 1 to 6 million transactions annually.
- Level 3: Merchants that process 20,000 to 1 million transactions annually.
- Level 4: Merchants that process fewer than 20,000 transactions annually.
Let’s take a look at how those levels affect the way you approach PCI DSS compliance.
Achieving PCI DSS compliance
PCI DSS is the result of collaboration between major card brands (American Express, Discover, JCB, Mastercard and Visa), with transaction processes closely monitored by the Payment Card Industry Security Standards Council (PCI SSC).
The objective is to ensure that card payments are subject to appropriate protections – and the first step to achieving that is to complete an assessment (the specifics vary based on your level), a quarterly network scan and the Attestation of Compliance Form.
For Level 1 organisations, the assessment should consist of an external audit performed by a QSA (Qualified Security Assessor) or ISA (Internal Security Assessor). They’ll perform an on-site evaluation of your organisation to:
- Validate the scope of the assessment;
- Review your documentation and technical information;
- Determine whether the PCI DSS’s requirements are being met;
- Provide support and guidance during the compliance process; and
- Evaluate compensating controls.
The auditor will then submit an RoC (Report on Compliance) to the organisation’s acquiring banks to demonstrate its compliance.
Organisations in PCI Levels 2-4 can complete an self-assessment questionnaire (SAQ) instead of an external audit. Level 2 organisations must also complete an RoC.
You can find out more about this process by reading PCI Audit Success in Nine Essential Steps.
This green paper help organisations to prepare for a PCI audit and ensure a successful outcome.
It contains:
- Nine essential tips to prepare for a successful RoC audit;
- A checklist of what the auditor will be looking out for on the day;
- Invaluable tips to avoid unnecessary delays and frustrations;
- Advice on identifying non-conformities before the audit takes place; and
- Guidance on how to choose the right QSA.
Self-assessment questionnaire
Several different types of SAQ apply depending on your merchant level and the way you process payment card information:
- SAQ A: For merchants that outsource their entire card data processing to validated third parties. This includes e-commerce transactions and mail/telephone order merchants.
- SAQ A-EP: For e-commerce merchants that outsource their payment processing but not the administration of the website that links to it.
- SAQ B: For e-commerce merchants that don’t receive cardholder data but control the method of redirecting data to a third-party payment processor.
- SAQ B-IP: For merchants that don’t store cardholder data in electronic form but use IP-connected point-of-interaction devices. These merchants may handle either card-present or card-not-present transactions.
- SAQ C-VT: For merchants that process cardholder data via a virtual payment terminal rather than a computer system. A virtual terminal provides web-based access to a third party that hosts the virtual terminal payment-processing function.
- SAQ C: For merchants with payment application systems connected to the Internet (no electronic cardholder data storage).
- SAQ D: For all other merchants not included in SAQ types A–C.
- SAQ P2PE: For merchants that use point-to-point encryption. It’s therefore not applicable to organisations that deal in e-commerce.
It’s essential that you select the right SAQ because each one has compliance requirements based on the ways payment card data is processed.
PCI DSS compliance made easy
For those looking for help completing their PCI DSS compliance requirements, IT Governance is here to help.
Our PCI DSS Documentation Toolkit contains everything you need to complete the project, including template documents and a document checker to ensure you select and amend the appropriate records.
The toolkit supports all self-assessment questionnaires, regardless of your specific payment scenario.
It’s fully aligned with the PCI DSS, so you can be sure that your policies are accurate and compliant. All you have to do is fill in the sections that are relevant to your organisation.
A version of this blog was originally published on 23 January 2020.
A well explained blogging, it detailed about the PCI DSS and basic requirements to set up which will help many companies to safeguard themselves from payment card fraud. Thanks for providing information on PCI DSS courses which will give complete information on the subjects. Many companies can take this opportunity and avoid fraudulent.
What if you are the program manager of a general purpose reloadable prepiad card program. You do not accept card payments but instead work with a qualified prepaid card processor to register and activate new card accounts for consumers. Do you follow the same transaction rules as a merchant, only substituting number of accounts on file instead of number of transactions processed?
Nice Article!!!
Thank you for sharing this article which is really interesting to know about PCI DSS Compliance levels.
Great Read. Do I have to fulfill PCI DSS requirements if I only take credit card information by phone?
If you process payment card transactions, the PCI DSS applies. It doesn’t matter how you obtain the information (by phone, in person, etc.).
Thanks for sharing the knowledge Luke.