Established in 2006, the Payment Card Industry Data Security Standard (PCI DSS) is a vital compliance rule for any organisation collecting, storing, and processing payments data. While it is not legally enforceable, PCI DSS violations are considered serious security flaws that could invite large penalties or even lead to a data breach. However, most organisations are yet to meet 100% PCI DSS compliance, as these standards are rigorous and may appear too big an investment for small businesses. In a recent contact centre compliance by NICE, 99% of respondents admitted that there was room for improvement in their compliance tools and software.
What is PCI DSS and Why Is It Important?
The Payment Card Industry Data Security Standard (PCI DSS) is a collection of rules governing how payment data is exchanged and utilised, envisioned by the Payment Card Industry Securities Standards Council and executed by major card providers such as Visa, Mastercard, American Express, Discover, and the Japan Credit Bureau or JCB. Its purpose is to prevent credit card fraud and close security loopholes during transactions that multiply fraud risks.
In 2021 and beyond, PCI DSS is extremely important for businesses of every size because:
- Omni-channel multiplies fraud risk - With customers making transactions on a variety of platforms and channels, a standardised set of rules is necessary to maintain security
- Data breach numbers are rising - The proliferation of customer data (both public and private) creates a landscape that’s prime for data breaches and customer privacy attacks
- Businesses now collect more data for personalisation - As transactions are recorded to power customer intelligence and analytics, companies must be careful to not expose card details.
- The geopolitical climate is sensitive - Cybersecurity is now closely linked with national security, and it is imperative to stay compliant in order to prevent more serious attacks
- Cloud systems add to vulnerabilities - Storing data on the cloud as opposed to restricting it to an on-premise environment has its own downside, making it vital to regulate which data is stored
Amid this high-risk environment, customer demands are continually evolving. But in a bid to provide convenient, flexible, and empowering experiences, companies cannot compromise on the security of payments and business transactions. This is where PCI DSS comes in.
PCI DSS lays down six clear objectives you must fulfil in order to demonstrate compliance and stay secure:
- Network security - Configure your network landscape in a manner that minimises risk exposure. Implement additional network components, such as a next-generation firewall (NGFW), that can reduce network-related risks
- Cardholder data protection - When stored, cardholder data must be secured through mechanisms like encryption and storage should be avoided wherever possible. All data transmissions must be encrypted end-to-end
- Vulnerability management program - Contact centres must have a cybersecurity program in place that includes vulnerability management. Deploy tools such as antivirus software, threat intelligence, application security testing, etc regularly
- Information security policies - You need a detailed policy document for information security and all personnel have to be trained accordingly. Update your documentation regularly and make PCI DSS training part of the onboarding process
- Security testing and monitoring - New vulnerabilities can creep in when you scale your systems, install new applications, update the software, or add new seats. Maintain detailed logs of all transactions, and test the landscape to detect vulnerabilities proactively
- Access control - Agent access to cardholder data (during real-time calls, through recordings, or CRM databases) has to be governed by least privilege and zero trust access policies. All-access records must be logged and audited
5 Best Practices for Maintaining PCI DSS Compliance
As you can see, PCI DSS isn’t a single, specific rule that you can implement in your contact centre. It is an overarching guideline that seeks to regulate the entire ambit of card-based payment transactions, both in your contact centre and your online/offline point of sale. Companies that achieve PCI DSS certification are viewed as highly trusted entities, and this certification is typically necessary if you want to transact with government bodies or operate in a regulated industry like healthcare or financial services.
Conversely, failure to implement PCI DSS can result in heavy fines even if there is no actual data breach. For example, the Information Commissioner’s Office (ICO) recently fined Ticketmaster UK £1.25 million for lapses in PCI DSS and GDPR compliance, despite the breach having been caused by a third-party application exploit.