PCI Compliance Information

The PCI DSS is comprised of 12 requirements. These requirements cover a full spectrum of topics necessary for data security. They range from removing sensitive card data from your payment terminals to implementing data security policies for your employees to follow.

In conjunction with the 12 requirements, the PCI Security Council has developed the Prioritized Approach, which provides guidance for non-compliant merchants striving to achieve compliance.

Your acquirer/ payment processor may require submission of documentation depending on your data security reporting level in order to validate PCI DSS compliance, such as:

• Report on Compliance (ROC)
• Self Assessment Questionnaire (SAQ) and Attestation of Compliance
• "Clean" security vulnerability scan by an Approved Scanning Vendor (ASV)
• Use of a Payment Application Data Security Standard (PA DSS) compliant payment application

Why is scanning important? The benefit of having a quarterly network scan is to ensure your payment environment is sealed off to individuals with malicious intent. In addition to safeguarding your customer's cardholder data, performing network scans is a requirement for ongoing PCI DSS compliance.

These scans are non-intrusive tests that involve probing external-facing systems and reporting on the services available through your Internet connection. For a complete list of Approved Scanning Vendors, visit the PCI Security Standards Council website.