adam-nunn

I'm a security and compliance professional with a passion for emerging cloud technologies. I specialize in risk, privacy regulations, and industry-standard security frameworks.

Sr. Director of Governance, Risk, and Compliance

Adam Nunn

Every business that accepts credit cards needs to be compliant with PCI, but your obligations vary dramatically depending on your size and structure.



If your business accepts credit card transactions, then you should be familiar with the Payment Card Industry Data Security Standard (PCI DSS). The rules (usually abbreviated as PCI) are a set of guidelines that seek to govern how businesses safeguard sensitive credit card information, with the goal of minimizing data breaches and fraud. Many merchants know PCI only as a mysterious surcharge from their credit card processor. But PCI compliance can become a serious and costly issue, especially if your bank unexpectedly demands that you prove compliance.

Here, we’ve created a straightforward guide that cuts through both legalese and technical jargon in order to explain what PCI is and how to determine your compliance obligations.

## PCI Definition and Key Concepts

Underneath the acronyms, PCI is actually very simple: a set of rules established by credit card companies to ensure that merchants are keeping their sensitive data secure.

### Background

PCI was [established in 2006](https://www.pcicomplianceguide.org/faq/#12) by Visa, Mastercard, Discover, American Express, and JCB, and it’s been updated periodically since then. The specific standards are written by a council created by the payment companies: the Payment Card Industry Security Standards Council (PCI SSC). However, the rules aren’t enforced by the council but by the card companies and [acquiring banks](https://www.merchantmaverick.com/what-is-acquiring-bank/).

### Compliance and noncompliance fees

It’s important to emphasize that PCI is not a law. However, given the clout of the five major card brands, as well as the credit card processors and acquiring banks, PCI is functionally mandatory. Credit card companies can issue fines for acquiring banks for noncompliance. Banks, in turn, will charge merchants a [PCI non-compliance fee](https://www.valuepenguin.com/credit-card-processing/pci-compliance-fee-explained#:~:text=Some%20merchants%20may%20also%20be,commonly%20around%20%2420%20per%20month.) and can even stop working with a business altogether.

Conversely, most credit card processors/merchant service providers also charge a monthly or annual [PCI compliance fee](https://www.merchantmaverick.com/pci-compliance-fees/). Many providers that charge this fee include services to make sure your business is PCI-compliant. However, some just tack on the surcharge without giving you anything in return.

### PCI Overview

All PCI rules relate back to a central goal: to encourage merchants to store as little credit card information as possible, so they are less vulnerable to data breaches and fraud. Meanwhile, PCI also helps craft guidelines for the service providers that handle cardholder data, minimize their exposure.

PCI helps to minimize risk by imposing lighter standards on merchants who do a few key things:

* Outsource credit card processing and data storage to trusted service providers.
* Regularly audit and update their security measures, such as encryption, password changes, etc.
* Keep internal systems as simple as possible. In the case of brick-and-mortar merchants, for instance, they point to Wi-Fi, in-store cameras, and physical terminals as threat vectors that hackers can use to steal data.

### PCI key terms

[PCI DSS defines a merchant](https://www.pcisecuritystandards.org/pci_security/glossary#M) as “any entity that accepts payment cards bearing the logos of any of the five members of PCI SSC.” So while the term “**merchant**” can evoke a traditional idea of retailers, the term here is much broader. It’s also important to note that debit cards, if they bear the logo of the major brands, also fall under the rules.

Meanwhile, PCI defines a **service provider** as an entity that is “directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This also includes companies that provide services that control or could impact the security of cardholder data.” So if a merchant uses Stripe or PayPal to handle e-commerce payments, those are service providers, but the category can also include your website hosting provider, your identity and access management (IAM) platform, and any other service that touches this data. Unsurprisingly, service providers can also be merchants since they too accept cardholder data as payment.

So what kind of data are we talking about? **Cardholder data** under PCI includes the card number, which PCI calls the “primary account number (PAN).” It can also mean the PAN, as well as the cardholder’s name, the card’s expiration date, or the security code.

## Does PCI DSS Apply to My Business?

The short answer is yes! If your business accepts card payments&mdash;whether in person, online or over the phone&mdash;PCI applies to you. However, your obligations under PCI vary dramatically depending on what type of business you have and how you handle payments.

The best way to determine your business’s obligations is to take the [self-assessment on PCI’s website](https://www.pcisecuritystandards.org/document_library?category=saq&document=saq). But there are multiple self-assessment questionnaires, so you need to determine which one best applies to your business. You can do that using this [PCI-provided table](https://www.pcisecuritystandards.org/pci_security/completing_self_assessment). Figure out which designation describes how you process credit card payments, and then take the appropriate questionnaire.

![PCI Questionnaire](https://images.ctfassets.net/23aumh6u8s0i/3Pij7WjlmS0GBMTCrnj5X2/e6f32e65e95e6e16d6e38469e9bfa2f5/pci_table)

You might notice that the vast majority of the merchant types above describe businesses that don’t store credit card information themselves. That’s in keeping with PCI’s overall preference for merchants outsourcing this storage to third-party professionals. Merchants who do choose to store credit card data themselves&mdash;for example, for the purpose of processing recurring payments&mdash;have among the highest compliance standards. Those merchants may be obligated to hire a [qualified security assessor (QSA)](https://www.pcisecuritystandards.org/assessors_and_solutions/qualified_security_assessors) to conduct an onsite audit to ensure a merchant meets their PCI DSS requirements.

Your PCI obligation also varies by level, based chiefly on your card transaction volume. Every business is assigned a PCI compliance level from 1-4, with level 1 having the highest standards. Unfortunately, these levels aren’t exactly straightforward, and, technically, each cardholder brand has its own set of levels. However, the Visa and Mastercard levels are generally considered standard, so they’re the ones we include here:

* **PCI compliance level 4**: For e-commerce: fewer than 20,000 annual Visa/Mastercard transactions. For all merchants: fewer than 1 million annual Visa/Mastercard transactions.
* **PCI compliance level 3**: This level applies only to merchants that process 20,000 to 1 million annual e-commerce transactions per year.
* **PCI compliance level 2**: All merchants who annually process between 1 million to 6 million Visa/Mastercard transactions, regardless of channel.
* **PCI compliance level 1**: Any merchant annually processing more than 6,000,000 Visa/Mastercard transactions via any channel. In addition, any merchant that has experienced a security breach that exposed cardholder information is automatically moved to level 1.

## PCI DSS Compliance Guidelines

Regardless of your merchant level or how you accept payments, there are some basic housekeeping steps you should take to keep up on your PCI compliance:

* **Conduct a quarterly vulnerability scan of your systems using a PCI-approved party**. This scan is an automated process that probes your systems to identity potential entryways for attackers. If you’re currently paying a PCI compliance fee to your merchant service provider, this is one of the services they should offer you.
* **Conduct an audit of your current credit card processes**. This doesn’t just mean the processing itself, but every touchpoint for that data, including both digital and physical access. If you’re not sure where to start, take a look at [PCI’s documentation](https://www.pcisecuritystandards.org/pdfs/Small_Merchant_Guide_to_Safe_Payments.pdf), which points out some common data security pitfalls. For example, if you’re a brick-and-mortar retailer, make sure you don’t have internet-connected security cameras pointed at your point-of-sale system. If you’re an e-commerce merchant and you process payments yourself, make sure internal access to payment pages is rigorously controlled.
The basic rule of thumb in a self-audit is that if there isn’t a strong business need for keeping cardholder data in-house, don’t do it. Such data makes you vulnerable to attackers, increases the likelihood that you’ll be found PCI-noncompliant, and puts you at risk of non-compliance with [global data privacy laws](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA/email/?email=elaine%40animalz.co).
* **Keep your security up to date**. At a minimum, that means regularly updating system passwords, installing patches to all software (especially antivirus software), and updates on your payment terminals. These are simple fixes that can prevent a lot of attacks.
* **Use responsible vendors and service providers for payments**. PCI SSC provides this [list of questions](https://www.pcisecuritystandards.org/pdfs/Small_Merchant_Questions_to_Ask_Your_Vendors.pdf) to ask vendors to ensure you’re working with partners who are themselves in compliance and who can support you in maintaining compliance.
* **Control internal access to data**. As the [PCI SSC’s guide for small merchants states](https://www.pcisecuritystandards.org/pdfs/Small_Merchant_Guide_to_Safe_Payments.pdf), “Access control is all important.” Implement strong access-control measures to ensure that employees can only access the amount of cardholder data they need to do their jobs.

You need an [IAM system](https://auth0.com/blog/what-is-iam/) that issues a unique ID to anyone who can access this information, so you can trace any breach to the source. If you have one “admin” login for an entire store, and every employee can use it, you’re in serious need of an IAM update.

Like your payment platform and firewall provider, your IAM partner needs to be PCI compliant. For example, in 2019, [Auth0 became](https://auth0.com/blog/auth0-completes-pci-dss-validation-for-iam/) among the first identity providers to achieve Level 1 compliance.

## Getting PCI-Compliant Is a Smart Business

Many small-business owners simply aren’t accustomed to thinking about their information security policy. Unfortunately, no merchant is too big or too small for hackers, and credit card data is some of the most valuable and sensitive information in existence. So while no one really wants to think about PCI DSS compliance, it might be just the nudge you need to update your information security policy and implement tighter security controls.

For more information on how an IAM partner can be a part of your data protection strategy, please [reach out to the professionals at Auth0](https://auth0.com/en/contact-us).

<include src="asides/AboutAuth0" />


What Is PCI? A Business Guide to Compliance

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

Auth0 announces its compliance with the Payment Card Industry (PCI) Data Security Standard (DSS). Learn more about what this means and the PCI Data Security Standard requirements.


**BELLEVUE, Wash. -- March 14, 2019 --** [Auth0](https://auth0.com/), a global leader in Identity-as-a-Service (IDaaS), is pleased to announce that it has validated compliance with the Payment Card Industry (PCI) Data Security Standard (DSS) version 3.2.1 as a "Level 1" service provider for its identity and access management services. Auth0 is one of the first identity providers in the industry to successfully undergo a third-party Level 1 PCI assessment.

The PCI DSS is a comprehensive set of standards that require merchants and service providers that store, process, or transmit customer payment card data to adhere to strict information security controls and processes. It was created by the founding brands of the PCI Security Standards Council, which includes American Express, Discover Financial, JCB International, MasterCard Worldwide, and Visa Inc. The standard includes twelve requirements that include the following information security topics:

- Security management
- Policies and procedures
- Physical security
- Network architecture
- User access management
- Network and systems monitoring
- Software development

The PCI Data Security Standard requires that any merchant that outsources the transmission, processing, or storage of payment card data to a third-party provider verify that the provider adheres to the standard. As a leading provider of identity and access management to merchants, Auth0 has proactively met this obligation to its customers.

"Modernization within the payments industry is creating exciting innovation in application development," said Joan Pepin, CISO and VP of Operations at Auth0. "With this modernization comes an even more critical need to protect sensitive payment card information. We are excited to achieve PCI Compliance and provide this added security assurance to our global customers."

The assessment was performed by Schellman & Company, LLC ([www.schellmanco.com](http://www.schellmanco.com/)), a globally accredited Qualified Security Assessor (QSA) firm that provides assurance and compliance services to global companies. The scope of the assessment included the applicable requirements of version 3.2 of the PCI Data Security Standard for validation of "Level 1" service providers. Following the completion of the assessment, a Report on Compliance was issued to reflect Auth0's full compliance with the PCI Data Security Standard.

For more information about the PCI Data Security Standard, please visit the PCI Security Standards Council website located at[  www.pcisecuritystandards.org](http://www.pcisecuritystandards.org).

<include src="asides/AboutAuth0" />

### **Media Contacts:**

Kasia Hall<br/>
Matter for Auth0<br/>
[khall@matternow.com](mailto:khall@matternow.com)<br/>
971-246-7898


"pci"