The requirements of the PCI DSS apply to ALL organizations or merchants, regardless of size or number of transactions, that accept, transmit or store any cardholder data.

Merchants that do not comply with the PCI DSS may be subject to fines, card replacement cost, costly forensic audits or brand damage should a data breach occur. Failure to complete your PCI registration annually, will result in a $19.95 monthly non-compliance fee billed to your merchant account. Completing your PCI registration and getting certified will eliminate you from being billed this fee.

It is important to understand Payment Card Industry Data Security Standard (PCI DSS) compliance is something that all merchants who accept credit cards are responsible for regardless of who your processor may be. Unfortunately there are costs associated with becoming PCI DSS compliant. Nationwide is pleased to be able to offer our PCI program through Comply Guard Networks at a very competitive price. Effective November 30th, all merchants will be billed an annual PCI Support Fee of $79. This fee covers the overall cost for Comply Guard Networks to support our merchants in both becoming and maintaining their annual PCI DSS compliance as well as any required network scanning if applicable.

While validation is not yet required, PCI DSS Compliance is mandatory. Many processors have already implemented or are in the process of implementing these types of programs. It is expected that validation will be required industry wide in the near future. Merchants should also consider why they would want to process with a company that does not take their data security seriously. PCI DSS programs are designed to help protect cardholder’s information and assist merchants avoid fines and risk potentially negative exposure. With the recent compromises in data security, it is essential that merchants understand the value that these programs provide.

If determined that upon completion of the SAQ with Comply Guard Networks that each of your locations are handled the same way in regards to PCI DSS Compliance, and that each location is not using an IP terminal/software configuration it is possible that a single fee may apply. Based upon information provided by the merchant’s SAQ, individual locations may be responsible for a PCI DSS Support Fee.

Multi-location merchants are defined as businesses that share the same Federal Tax ID.

The individual card brands are requiring that the Merchant Banks/Processors implement individual PCI DSS Compliance Program to educate merchants on compliance and ensure that they meet PCI DSS Compliance requirements. They have required that all Merchant Banks/Processors have a plan in place to ensure that all of their merchants obtain and maintain compliance with the standard. Most of the breaches you hear of in the news are large retailers, but many people do not realize that over 80% of compromises occur at small merchant locations.

1. The first step is to click on the link ” Get into Compliance” and answer a Self-Assessment Questionnaire (SAQ); this will tell us how you process credit cards. Your answers will determine what additional steps are necessary if any.

• As part of the SAQ process, all merchants must confirm that a written security policy is in place (PCS/Comply Guard Networks merchant portal will provide you with the required security policy for your business).
• Merchants who come into contact with credit card data at any point in their daily routine are also required to have a Security Awareness Training program in place that informs their employees of the importance of data security (merchants can access a Security Awareness Training program in the PCS/Comply Guard Networks merchant portal).

2. If you electronically store cardholder information or if your processing systems have any internet connectivity, you may be required to complete a passing vulnerability scan for each IP address you own. Comply Guard Networks is an approved and Certified Scanning Vendor (ASV) and will provide such scans as part of the program. Note scanning does not apply to all merchants.

3. Finally, each merchant must submit the SAQ, evidence of a passing scan (if applicable), and the Attestation of Compliance, along with any other requested documentation, to your acquirer. PCS/Comply Guard Networks will submit this information on your behalf as part of the program.

All Acquirers are responsible for ensuring that all of their merchants comply with the PCI DSS requirements, therefore, all processors are required by the card brands to implement a PCI DSS Compliance Program. Connecting to a competing processor will NOT avoid the need to get into PCI DSS Compliance nor the fees involved. We have partnered with ControlScan based on the fact that they provide the best value for our merchants while providing full support to help you get into compliance.

The time it takes to achieve compliance is dependent upon how you process credit card data. If a vulnerability scan is not required, achieving compliance can be completed in a short amount of time. This of course depends on your availability to work with Comply Guard Networks in completing the SAQ. In an effort to make the process go faster, PCS will provide toll-free support to assist you.

Merely using a third-party software company does not exclude you from PCI DSS Compliance. It may cut down on their risk exposure and consequently reduce the effort to validate compliance. However, it does not mean you can ignore the PCI DSS. All merchants are required to complete the SAQ annually.

Getting into compliance also addresses internal security practices and procedures behind handling credit card data. One of the leading causes of data breaches is due to employee error or carelessness when handling sensitive information. This is why proper policies should be in place and a formal Security Awareness Training should be conducted. Your business must protect cardholder data when you receive it. You must also ensure that your software provider’s application and card payment terminals comply with respective PCI DSS standards and do not store sensitive cardholder data. You should request a certificate of compliance annually from such providers to ensure they are compliant. PCS can assist you with this.

Utilizing a compliant software payment application is a best practice towards achieving compliance, but PCI DSS Compliance also covers data security, physical security and network security, therefore, you are still required to complete an annual PCI DSS Compliance Review via the PCS/ Comply Guard Networks merchant portal.

Yes. All businesses that store, process or transmit payment cardholder data must be PCI DSS Compliant.

A network security scan involves an automated tool that checks a merchant or service provider’s systems for vulnerabilities. The tool will conduct a non-intrusive scan to remotely review networks and Web applications based on the external-facing Internet protocol (IP) addresses provided by the merchant or service provider.

The scan will identify vulnerabilities in operating systems, services, and devices that could be used by hackers to target the company’s private network. As provided by an Approved Scanning Vendors (ASV’s) such as Comply Guard Networks the tool will not require the merchant or service provider to install any software on their systems, and no denial-of-service attacks will be performed.

If you electronically store cardholder data post authorization or if your processing systems have any internet connectivity, a quarterly scan by a PCI SSC Approved Scanning Vendor (ASV) is required.

Every 90 days (once per quarter). Scans must be conducted by a PCI SSC Approved Scanning Vendor (ASV). Comply Guard Networks is a PCI Approved Scanning Vendor and will provide such reporting as needed on your behalf as part of the program.

Once you have completed your PCI DSS Registration, you may call Comply Guard Networks toll-free support number as they will provide guidance in helping you understand the vulnerabilities found on your scan report, if any. Comply Guard Networks will make recommendations on how to correct the issue(s), and arrange additional scans if needed.

Yes, home users are arguably the most vulnerable simply because they are usually not well protected. Adopting a ‘path of least resistance’ model, intruders will often zero-in on home users – often exploiting their ‘always on’ broadband connections and typical home use programs such as chat, Internet games and P2P files sharing applications. Comply Guard Networks scanning service allows home users and network administrators alike to identify and fix any security vulnerabilities on their desktop or laptop computers.

The Standard can be found on the PCI SSC’s Website.