PCI DSS: define the actual responsibility

What PCI DSS addresses

The Payment Card Industry Data Security Standard defines security requirements for applicable environments that store, process, or transmit payment account data. Exact applicability and validation processes depend on the merchant's environment and relationships.

A processor's PCI portal or monthly charge is not sufficient evidence that a merchant satisfies applicable requirements.

Identify the card-data environment

Document where card information enters the business, which systems handle it, what providers are involved, whether people can access sensitive information, and how payment software/devices are configured.

• Card acceptance channels: in person, phone, ecommerce, recurring
• Payment terminals, applications and integrations
• Third-party service provider responsibilities
• Employee procedures and access controls
• Validation documentation and evidence of remediation

Avoid two common mistakes

Do not assume outsourcing all processing removes every merchant obligation. Also do not assume buying a particular product automatically solves the entire security program.

Request the appropriate current guidance from the PCI Security Standards Council, acquiring institution, provider, or qualified security assessor when the applicability is complex.

Security and vendor decisions

Contract terms should make support responsibilities clear, including patching, logging, access changes, incident response and the boundaries of a provider's certification or assessment.