PCI DSS compliance is mandatory for any organization that accepts or processes payment cards, yet shockingly, a recent study by SecurityScorecard found that over 90% of U.S. retailers fail to meet four or more PCI DSS requirements.
Compliance with PCI DSS is not something to be taken lightly. If you are found non-compliant in the wake of a breach, the potential penalties are severe. The credit card companies that mandate PCI DSS compliance could levy fines amounting to tens or even hundreds of thousands of dollars; if you are unable to pay the fines, you will no longer be able to accept their cards.
Additional fallout could include:
* Some state-level data privacy laws mirror PCI DSS compliance standards or refer to them directly; non-compliance could result in your business running afoul of your state’s laws.
* Federal law enforcement may open an investigation to ensure that credit card data stolen from your organization is not being used to finance terrorist activities.
* Angry customers could decide to file costly civil lawsuits against you.
* If you file a cyber insurance claim, your provider may deny it.
The stakes are too high to leave compliance to chance. Utilize these best practices to help maintain PCI DSS compliance:
Monitor POS Terminals for Card Skimmers
If you have brick-and-mortar locations, train employees to monitor POS terminals for card skimmers. While unattended terminals in self-checkout areas are most at risk, card skimmers have also been found on terminals in human-staffed checkout lanes; they take only a few moments to install.
Always Change Default Manufacturer Passwords
PCI DSS compliance requires changing default, manufacturer-provided passwords on all equipment prior to connecting it to the network. These passwords are widely available online, often right on the manufacturers’ websites, and they’re the first thing any hacker that wants to break into your system will try.
Make Sure Your Employee Training is Relevant to Your Industry
PCI DSS compliance requires organizations to provide employees with security awareness training; make sure this training is relevant to your industry and organization. The cyber security and compliance issues that retail employees encounter will be different than those found at a collection agency or a healthcare facility.
Understand that Compliance is a Continuous Effort
Nearly all the retailers SecurityScorecard found out of compliance with PCI DSS failed requirement no. 6, which is about developing and maintaining secure systems and applications through prompt installation of software security updates and implementing secure software development practices and change control protocols. Your PCI DSS compliance protocols should not be centered around passing your annual audit but maintaining a secure payment card environment year-round.
Use a GRC Automation Solution
Today’s data environments are highly complex, and technology changes rapidly. Keeping up with PCI DSS compliance requirements can be challenging, especially if your company is still using spreadsheet software. Upgrading to a modern GRC automation solution such as Continuum GRC’s IT Audit Machine (ITAM) will help you prepare for your annual audits and maintain continuous compliance year-round far more quickly, easily, and for less money.
Finally, don’t make the mistake of thinking that PCI DSS compliance — or compliance with any framework or standard — equals cyber security. Compliance is the starting point for enterprise cyber security, not the do-all, end all.
Michael Peters is the CEO of Lazarus Alliance, Inc., the Proactive Cyber Security™ firm, and Continuum GRC. He has served as an independent information security consultant, executive, researcher, and author. He is an internationally recognized and awarded security expert with years of IT and business leadership experience and many previous executive leadership positions.
He has contributed significantly to curriculum development for graduate degree programs in information security, advanced technology, cyberspace law, and privacy, and to industry standard professional certifications. He has been featured in many publications and broadcast media outlets as the “Go-to Guy” for executive leadership, information security, cyberspace law, and governance.