A New 12-Step Program: PCI DSS compliance basics

We’ve discussed the issue of “Paying for Peace of Mind” when it comes to Payment Card Industry Data Security Standards (PCI DSS).  As we noted, many Merchants are paying a PCI Compliance Fee to their current processor with little or no security benefit.  In many cases, it is just another revenue stream for the processor.  Because of the seemingly confusing nature of credit card statements, most Merchants pay the fee because they “just don’t understand the bill in the first place”. 

But what does it take to become PCI Compliant?  Most Merchants – especially small ones – don’t have a clue.  From a Best Practices standpoint, it’s all pretty much based on common sense.  So let’s go over them one by one.  When you get your head around what actually needs to be done, just paying for the peace of mind will seem counterintuitive to how you run all other aspects of your business.

There are 12 requirements to building a PCI Compliant Network, our comments are in italics.

A Fee by Any Other Name: PCI Compliance Fee – What are you paying for?

Obviously, when it comes to accepting credit cards, nothing is more important than protecting your data. A security breach from processing credit cards can expose companies to fines, the inability to accept credit cards and the loss of your customer’s confidence -- and there is no question about it: credit card fraud and theft are on the rise.

But as a course of business, we are constantly reviewing competing credit card processing statements for our clients. Among many of the confusing or ambiguous “fees” our clients tend to pay, there is one that always strikes me as a pure payday for the some credit card processors: The PCI Compliance Fee.

It goes by other names of course, but it almost always has to do with

• Payment Card Industry (PCI) compliance to Data Security Standards (DSS); and
• Giving the Merchant the impression they are in compliance with those standards.