The Best Practice Network Guidelines | The Best Practice Network

• Best Practice » Compliance » Compliance Management » Compliance with Payment Card Industry (PCI) » Compliance with Payment Card Industry (PCI)

Payment card systems have become an essential best practice at a global scale. The main reason is security for both customers and business people. As the use of plastic payment cards has grown, so has the demand for quicker services with safety and reliability for financial institutions.

Businesses which use payment cards for payment must ensure best practices to ensure the effectiveness of their services. This is why most IT managers and business owners need to have adequate knowledge about the Payment Card Industry (PCI). There are usual concerns about the amount of time and budget which will be invested into maintaining and handling the payment by card system. If there are breaches in the system needed to sustain the PCI, there will be consequences which will amount to losses worth millions of dollars. Therefore there must be best practices to ensure proper risk management and compliance with the PCI. These best practices include compliance with the requirements for a comprehensive and formal security system to use payment cards.

PCI Compliance

There are four levels of PCI compliance which differ based on the number of PCI transactions annually and Payment Card Industry Data Security Standard (PCI DSS) requirements. To ensure PCI compliance there must be a security framework in place such as the ISO 17799.

Best Practices Required for PCI

• Breach Examination: Managers will have to check for possible cracks or breaches in the fulfillment of requirements for PCI. This is the first and most important requirement for starting the use of the PCI or maintaining it. The Self Assessment Questionnaire (SAQ) has six sections which are based on the DSS requirements. These are meant to assist managers in examining whether they have the controls and tools needed for PCI compliance.
• PCI Data Policies and Procedures: Managers and business people implementing PCI must establish PCI data policies and procedures in order to be able to store data to a certain limit and for a particular time period.
• Data Allocation and Information: Users of the PCI must know exactly where their relevant data is or will be stored for future reference. There is need for best practice of proper data management. Additionally, managers must be able to identify the payment acceptance channels, data flow and locations where the PCI data is stored.
• Establish the Data Encryption Process: Ensuring the security of your clients and customers is an important best practice. Most merchants and users of the payment cards send unencrypted information about their credit card via emails. Managers must create a program to automatically encrypt the data for security purposes.
• Avoid Track Data: Track data is encoded information stored within magnetic strips at the reverse side of a credit card at a Point-of-sale (POS). Hackers track this data and target retailers using the particular system. Additional adjustments to protect track data must be implemented as best practices to implement PCI compliance.
• Avoid Unsecured Wireless Networks: Business people implementing PCI compliance must not use unsecured wireless networks to transmit data because it is exposing the users to risk of hacking.
• PCI Training: There will be need for proper training of the staff members on how to use the PCI Qualified Security Assessor (QSA). There are specific PCI requirements on how to handle credit card data which must be followed appropriately.
• Ensure Physical Security: Managers and business people using PCI must deploy the necessary security systems and associated peripherals necessary for physical security. There must be no unauthorized physical access to information about the PCI transactions and track data.

With these best practices, PCI compliance will be effective and payment processes using credit cards will be secure and effective. Therefore, using the PCI is an important best practice.

Further reading: Corporate Governance | Audit | Performance Improvement