Developed by the major credit card companies, PCI DSS stands for Payment Card Industry Data Security Standard, and was designed to prevent credit card fraud when retailers and other organizations process or store credit card information. It is mandatory that a business that stores, processes, or transmits credit card data be PCI DSS compliant. If they are not, then they can lose the privileges which allow them to process these transactions or be severely fined.



Here is what PCI DSS does for an organization that processes credit card transactions:

Protects cardholder data that is being transmitted through the installation of a firewall system.

Protects cardholder data that is stored within a system.

Does not allow physical access to credit card data.

Networks through which credit card data is transmitted are encrypted.

Does not allow Business need-to-know access to cardholder data.

All merchants and organizations using PCI DSS must periodically validate their compliance with the system. This is usually done via auditors. However, smaller companies that process less than 80,000 transactions annually can simply fill out a self-assessment questionnaire.

Consumer protection

The credit card has become the primary way in which many people pay for goods and services. Consumers are concerned about the security of their accounts due to fraud and high profile security breaches reported on in the news. Consumers understandably want to protect their account information in order to prevent identity theft. They want the confidence of knowing that their information is secure and this is exactly what PCI DSS does for the customer. It secures their information so that no other parties have access to their name, address, phone number, social security number, license number, and other pieces of data that can lead to strangers taking this information and using it for their own benefit.

The consumer can feel secure that PCI DSS regulates the policies, procedures, network architecture, design of the managing software, management of the security standards, and all protective measures used to protect the consumer. It is true that PCI DSS does offer protection for the business, but it is the consumer that is the target by those who wish to steal information. As a result, businesses may be attacked by individuals wishing to steal information, but having PCI DSS in place prevents access to this information.

Business protection

A business that houses and transmits large quantities of consumer credit card data can be the target of hackers wishing to gain access to that information. Without PCI DSS in place, this information would be easy to access. However, a business must employ PCI DSS or they risk losing their credit card privileges and be forced to pay large fines. They could lose a lot of business this way since a majority of consumers use credit cards to pay for their transactions.

The business is protected by using PCI DSS because they are able to accept credit cards thus increasing their profitability while simultaneously protecting businesses from disputes if fraud is ever alleged. PCI DSS compliance is designed to prevent fraud from occurring, however if a breach were ever to occur, detailed records are kept allowing businesses to resolve any dispute quickly.

PCI DSS is put in place to benefit the consumer and regulate the business in respect to credit card use. Without it, performing a transaction via credit card would be a risky transaction and that is why the credit card companies put PCI DSS in place. The consumer and the business should be able to be confident about all phases of the transaction and that is what this security system does.