All businesses that handle payment card data, no matter their size or processing methods, must follow these requirements and be PCI compliant.
With the rise in data breaches comes the rise in changes and rules to the PCI DSS. For many businesses, getting PCI compliant is considered an unnecessary chore, and the fines breached businesses are given for not being compliant seems to increase that resentment.
So what’s the point of the PCI DSS? Why should businesses be so concerned about getting PCI compliant? And is there any benefit to being compliant with the PCI DSS? We believe so.
The Payment Card Industry Data Security Standard (PCI DSS) is a written standard, created by the major card brands and maintained by the Payment Card Industry Security Standards Council (PCI SSC). The PCI DSS contains technical requirements which protect and secure payment card data during processing, handling, storage, and transmission. All businesses that handle payment card data, no matter their size or processing methods, must follow these requirements and be PCI compliant.
It’s important to protect the data of your business and your employees. While you may be paying attention to physical security in your business, are you dedicating enough time to protect your information digitally? Between malware threats, remote-access attacks, and social engineering, it’s important to take the proper precautions to keep your computers, networks, and servers secure.
The whole purpose of the PCI DSS is to protect card data from hackers and thieves. By following this standard, you can keep your data secure, avoiding costly data breaches and protecting your employees and your customers.
See also: 3 Data Security Best Practices
Would you go to a business if you knew it was likely your credit card information could get stolen? Probably not.
Customer confidence can really affect whether your fiscal year is profitable or not. People are less likely to take your business if they don’t feel confident in you keeping their data safe. Two-thirds of US adults wouldn’t return to a business after a data breach. Should you get breached, or if your customers aren’t confident in your security, you could lose business.
Getting PCI compliant and promoting that to your customers shows your clients that you are serious about security and you’re taking every precaution to keep their payment data safe. It gives them (and you) some peace of mind.
Your clients trust you with their card data as they make transactions in your business. Should you get breached, you’re not the only one that suffers. Your clients card data needs to be protected by your business. You are responsible for keeping their data safe while it’s in your possession.
Remember that if you do fail to protect your customer’s data, you are liable to lawsuits and fines, especially if you falsely told them your business was secure.
The PCI DSS provides a baseline of security requirements that help businesses know what to do and where to start on their security program.
Many organizations we speak to simply don’t know where to begin with information security. Some may think simply locking the doors to their business is enough, others may not even see the need to secure their data. The goal is to reduce data breaches and following the 12 requirements provides a strong foundation.
The PCI DSS provides a standard that every business can and should follow. What’s helpful is the standard does have specific rules for different businesses, depending on size, type, methods of storing card data, etc.
Not sure if you’re compliant? Let’s talk about what you need to do.
Should you get breached, not only will you deal with the loss of data, but you may deal with fines and lawsuits from customers and other organizations.
A good example is the Wyndham Hotel breach. After they were breached three times, Wyndham Hotel was sued by the Federal Trade Commission because they had falsely said they were secure after each breach. This lawsuit ended in a settlement, but it shows what repercussions you could get in the event of a data breach.
Other fines can include customer lawsuits, third-party lawsuits, government fines, card brand fines, and more.
If you’re PCI compliant, you can reduce these fines and reduce the amount of lawsuits and liability your company may incur.
See also: Computer Security and The FTC: Suing Hacked Companies
Data breaches can cost you a lot in both money and customer confidence. There’s the cost of replacing credit cards, paying fines, and paying compensations for what the customers have lost, not to mention investigation costs and audits. It all adds up pretty quickly.
Remember the Target breach? What you may not remember is how much it cost the business, which was over $162 million in 2013 and 2014. That’s a pretty heavy price to pay for not being secure.
Here’s a list of average costs your business could sustain in a data breach
So the total cost of a data breach could range between $77,000 and $875,000.
See also: How Much Does a Data Breach Cost Your Organization?
For many businesses, a data breach could easily shut them down for good. Target was fortunate to have enough capital and income to cover the costs, but most businesses aren’t that lucky.
Getting compliant with the PCI DSS will help reduce cost by helping to prevent data breaches in the first place, but to also help prevent fines. If you can prove you were compliant, the fines won’t be as bad if you weren’t making the effort.
See also: 5 Simple Ways to Get PCI Compliant
While many businesses may not see the PCI DSS is necessary, it is important to both businesses and their customers that they follow the requirements. After all, they’re handling valuable information about their clients, and should that information get stolen, it has repercussions beyond just a simple theft.
See also: 3 Tips to Light a PCI Fire Under Your Merchants
Also keep in mind that the PCI DSS is the bare minimum you should do to safeguard against breaches that have occurred. You should be compliant with PCI DSS and build from there to address issues that could be specific to your industry or environment.
Every PCI DSS requirement is there because a breach could have been prevented by having that control in place.
Take the extra time and money to make sure your business is complying with the PCI DSS standard. By doing so, you’re protecting your business, your employees, your clients, and your brand.
.svg)
