Introduced in 2006, the Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements designed to protect online shoppers from cyber thieves. Though the standards do vary from small to large businesses, all companies that accept credit card payments through payment gateways must comply with PCI DSS.
One common misconception is that small companies that do not do much business online do not have to abide by these rules. But the truth is that is just as important for a small company to adhere to PCI, maybe even more so. The reason for this is simple: all companies that violate PCI DSS are subject to the same fines. And these penalties obviously have a much greater impact on small companies than they do on large ones.
On average, a business will be fined five-thousand pounds if it is discovered that it is violating PCI DSS. And when credit card theft occurs on an unprotected site, the company will be held financially responsible. Of course, PCI DSS does not make a site 100 percent secure and theft still occurs even on protected sites. The only difference is that sites that comply with PCI DSS are not held financially responsible.
How does a website become compliant? There are three basic validation tools that are used to ensure PCI DSS compliance. The first and most popular is the Self-Assessment Questionnaire (SAQ). Every company that sells on the internet must complete an SAQ at least one a year. There are several different versions of the test based on the size of the company, so it is import to select the right one.
Next there is the PCI SCC validation scan. The scan is only required for companies that have external facing IP addresses. Because these websites are particularly susceptible to attacks, the scan must be administered by an Approved Scanning Vendor (ASV) on a quarterly basis.
Lastly, there are Qualified Security Assessors (QSAs). These trained professionals will check your website for inconsistencies and make certain that you have properly completed the SAQ. If they find no major issues, the QSA will reward the company with a certificate of compliance, which can then be submitted to the merchant service provider.