At Coeo we’ve supported a large number of retail organisations to ensure that their data platform is Payment Card Industry Data Security Standards (PCI DSS) compliant. As this topic is so critical for businesses in this sector and beyond, we’ve put together a brief introduction to PCI DSS.
The PCI DSS Council is a body put in place by credit payment card brands, in order to protect customers (and, ultimately, the banks) from fraudulent activity. It is particularly important to those working in the retail industry as a lot of ecommerce providers take large volumes of card payments, however its scope is not limited to this sector and affects anyone taking card payments.
The PCI DSS standard has some very explicit compliance requirements and control processes that companies have to put in place. It also has to be audited externally or internally, so it’s worth reviewing the PCI DSS documentation. The standard is currently on version 3.2.1, which was released in May 2018.
PCI DSS applies to any organisation that stores, processes or transmits sensitive cardholder data, such as the long card number, CVV number or associated cardholder information. Any computer or service that comes into contact with this data is within the scope of the company’s PCI DSS annual audit.
For full details of requirements, we recommend reading the PCI DSS documentation. However, here is a run-down of some of the major points relevant to data professionals:
The most important consideration when dealing with PCI DSS is scope. It’s important to scope access to PCI DSS sensitive data down to the smallest possible subset of services and servers, as that reduces the amount of auditing that the organisation needs to do. The business then needs to keep that boundary well defined so that they can ensure they know exactly where that card data is, how it’s processed and what and who has access to it.
Over the past few years, many organisations have moved responsibility for PCI DSS data on to their payment provider. Those that choose this option still make sure they are aware of where the data is, how it is processed and who has access to it so that they really understand what data they’re holding, how they’re processing it and how their systems interact with that data.
Ultimately, organisations that fail their audit may no longer be able to have a merchant account, and therefore cannot accept card payments. This will have a huge effect on sales as they will be effectively unable to trade online.
There are also risks linked to GDPR. Non-compliance with this data protection standard carries very severe penalties, including a fine of up to 4% of global turnover.
Microsoft have written some security architectures or visual architectures specifically for PCI DSS. They have created a PCI DSS Blueprint, which provides you with some best-practice reference architectures that are compliant with the standard. These are especially helpful for companies trying to take a solution that they’ve created and migrate it into Azure. They will still need to make sure that reference architectures adhere to their internal standards, but they are a good place to start.
Our team of consultants have done a lot of work with internet retailers over the past 10 years. We’ve helped customers design the data platforms that sit behind their systems and ensure that they’re building these to best practice in terms of security in accordance with PCI DSS standards. Our Dedicated Support team works alongside our customers to make sure they are doing everything they can do to protect and restrict access to their data to keep their systems operational and performant.