In April this year a series of new protocols to the PCI-DSS compliance regulations were brought in, designed to increase security when making credit card payments online.

All companies from the smallest upwards who accept credit card payments online must comply with these regulations. There are more than 300 new protocols to adhere to which cover all aspects of online payment security including how credit card data is managed by companies to how servers are run. From July onwards all servers for all e-commerce sites should be screened three times year, as part of a system of penetration tests – which will scan them for over 3000 potential risks.

Preparing for these changes in online payments is proving a daunting prospect for many, especially for smaller firms. Most of these will lack the in depth knowledge required, for example, about how servers work. Many are being forced to turn to the services of specialists to ensure they will be ready for the July date when they will be assessed.

To add to the expense some of the new regulations include having to have surveillance equipment fitted in order to keep watch over servers which hold sensitive card data; data including all the information held about customers, from their name, telephone number, address and email and also their credit card numbers.

PCI DSS stands for Payment Card Industry Data Security Standard and is produced by the PCI Security Standards Council. The regulations are not laws but companies are contractually obligated to comply with them or face fines from payment providers if they do not do so.

The first step in preparing for processing compliance is to fill in a self-assessment questionnaire. There are also handbooks available which detail how to understand and implement PCI compliance procedures.