Protecting credit card information is of fundamental importance in today’s digital era, where financial transactions increasingly take place online. As consumers entrust their sensitive payment data to companies, ensuring the protection of credit card information becomes a key priority. Unauthorized access or breaches can have serious consequences, including financial losses, reputational damage and legal liabilities.
What is PCI DSS?
PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards designed so that all companies that accept, process, store or transmit credit card information can ensure a secure environment.
The PCI SSC (Payment Card Industry Security Standards Council) was launched on 7 September 2006 to promote the continuous improvement of Payment Card Industry (PCI) security standards, with particular attention to improving the security of payment accounts throughout the transaction process. PCI DSS is administered and managed by the PCI SSC (www.pcisecuritystandards.org), an independent body created by the major payment card brands (Visa, MasterCard, American Express, Discover and JCB).
Who does PCI DSS apply to?
PCI DSS applies to ANY company, regardless of size or number of transactions, that accepts, transmits or stores cardholder data. So, obviously, this includes BPO, outsourcing service providers and call centers!
Obtaining PCI DSS certification is an important achievement for any company that handles payment card information. It demonstrates that the company has implemented robust security measures to protect sensitive cardholder data and is committed to maintaining those measures over time.
How can PCI DSS certification be obtained?
To achieve PCI DSS compliance, companies must implement a series of security controls and procedures designed to protect payment card information. These controls and procedures are specified in the PCI DSS standard, which outlines the requirements in areas such as: network security, access control and data encryption.
What are the phases of the assessment process?
The assessment process involves several phases, including:
- Scope
Involves defining the scope of the assessment, which typically includes all systems and processes that store, process or transmit payment card data.
- Gap analysis
Involves identifying any gaps between the company’s current security controls and the PCI DSS requirements. Any identified gaps must be addressed before the company can become compliant.
- Remediation
This phase concerns the implementation of security controls and procedures to close any gaps identified during the gap analysis.
- Assessment
Involves an independent evaluation of the company’s security controls and procedures against the PCI DSS requirements.
If the company’s security controls and procedures meet all PCI DSS requirements, the QSA issues a certification attesting that the company complies with the PCI DSS standard.
What are the official requirements for PCI DSS compliance?
There are 12 requirements to achieve PCI DSS compliance.
- Use and maintain firewalls
Install and manage firewalls to protect the network from unauthorized access.
- Adequate password protections
Use strong passwords and change them regularly. Do not use default passwords.
- Protection of cardholder data
Keep the storage of cardholder data to a minimum and constantly protect it. Do not store sensitive authentication data after authorization.
- Encryption of transmitted data
Use advanced encryption methods to protect cardholder data during transmission over public networks.
- Use and maintain antivirus
Install and regularly update antivirus software to protect against malicious software.
- Keep software properly updated
Ensure all software is up to date with the latest security patches and updates.
- Restrict access to data
Restrict access to cardholder data on a need-to-know basis. Use role-based access controls to limit access.
- Unique IDs for access
Assign a unique ID to each user with access to cardholder data.
- Restrict physical access
Protect cardholder data by restricting physical access to data storage and processing areas.
- Create and manage access logs
Keep detailed records of all access to cardholder data, including logs of user and system activity.
- Vulnerability scanning and testing
Regularly scan and test for vulnerabilities in the network and systems.
- Documented terms and conditions
Create and maintain comprehensive security terms, conditions and procedures and ensure they are communicated to all relevant staff.
By meeting these 12 requirements, the company takes the necessary measures to control cardholder data and maintain a secure network. PCI DSS compliance is not a one-time event but an ongoing process, and it is important to regularly review and update security measures to keep pace with emerging risks.
What are the PCI DSS compliance levels?
The PCI DSS compliance levels are classifications that determine the requirements and validation processes for companies based on their annual volume of credit card transactions. These levels are set by the major card brands (Visa, Mastercard, American Express, Discover and JCB) to ensure consistent security measures across the payment card industry. The PCI DSS compliance levels are as follows:
- Level 1
This is the highest compliance level and applies to companies that process over 6 million card transactions per year or those identified as high-risk entities by the card brands. Level 1 merchants must undergo an annual on-site assessment by a Qualified Security Assessor (QSA) and submit a Report on Compliance (ROC) to the card brands.
- Level 2
Level 2 applies to companies that process between 1 million and 6 million card transactions per year. Merchants in this case must annually complete a Self-Assessment Questionnaire (SAQ), conduct quarterly vulnerability scans by an Approved Scanning Vendor (ASV) and submit an Attestation of Compliance (AOC) to their acquiring bank.
- Level 3
This level applies to companies that process between 20,000 and 1 million electronic transactions per year. Level 3 merchants must complete an annual SAQ and conduct quarterly vulnerability scans by an ASV. They also submit an AOC to their acquiring bank.
- Level 4
This level applies to companies that process fewer than 20,000 e-commerce transactions per year or up to 1 million card transactions per year through other channels. Level 4 merchants must complete a SAQ each year and may need to conduct quarterly vulnerability scans based on their acquiring bank’s requirements.
It is important to note that the specific validation requirements may vary depending on the card brand and the acquirer (i.e. the financial institution that enables card payments). Merchants should consult their acquirer to determine the appropriate compliance level and the corresponding validation requirements.
PCI DSS and We Are Fiber
We Are Fiber is proud to announce that it holds PCI DSS compliance certification, which testifies to our ongoing commitment to maintaining the highest data security standards in our call center and BPO outsourcing services.
How did We Are Fiber obtain this certification?
- Protection of sensitive payment card data
At We Are Fiber we understand the fundamental importance of protecting sensitive payment card information. As a reliable provider of customer support services, we recognize that our clients depend on us to safeguard their customers’ payment data. With our PCI DSS compliance certification, our clients can be confident that we are following the strictest security protocols and procedures to keep their customers’ payment data safe and protected.
- Customer support services
In addition to our commitment to data security, We Are Fiber is proud of the quality of its customer support services. Our teams of highly qualified professionals are dedicated to providing first-class customer support services that meet the highest quality standards. We believe that customer satisfaction is the key to success and we strive to ensure it.
- Regular quality controls of activities
To consistently provide high-quality customer support services, we conduct regular quality controls of our activities. These audits allow us to identify areas for improvement and make changes to continuously improve our services. Our commitment to quality is also reflected in our ISO 9001:2015 certification, which demonstrates our adherence to a rigorous quality management system.
To conclude…
data security and quality customer support are essential components of our call center and BPO outsourcing services. Our PCI DSS compliance certification and other important certifications such as ISO 9001:2015 are proof of our commitment to providing our clients with exceptional services that meet the highest security and quality standards.
We Are Fiber will continue to prioritize data security and quality customer support across all operations. We are committed to meeting the ever-evolving needs of our clients and providing them with exceptional services that exceed expectations.
