Is Your Retail Software Compliant with PCI DSS?

Another hot-button topic for retailers searching for new retail software is Payment Card Industry Data Security Standard (or PCI DSS). PCI DSS is a program created by the five major credit card companies, including Visa, MasterCard, American Express, Discover, and JCB. The program serves as a guideline for retailers processing credit card payments and works to prevent security issues, such as hacking and credit card fraud.

Retailers that process, store, or transmit credit card numbers must be PCI DSS compliant, or they risk losing the ability to process credit card payments.

What Is PCI DSS?

PCI DSS is a combination of five previously separate programs:

• VISA Cardholder Information Security Program (CISP)
• MasterCard Site Data Protection
• American Express Data Security Operating Policy
• Discover Information and Compliance
• JCB Data Security Program

In December 2004, the five major credit card companies aligned and created PCI DSS version 1.0. In September 2006, the PCI DSS program was updated to version 1.1.

PCI DSS Requirements

Currently, PCI DSS specifies 12 requirements which are organized into six basic objectives:

Objectives	Requirements
Build and Maintain a Secure Retail Point of Sale System	Install and maintain a firewall configuration to protect credit card information Do not use vendor-supplied defaults for retail point of sale system passwords
Protect Cardholder Data	Protect cardholder data stored in your retail point of sale system Encrypt transmission of cardholder data across open, public networks and the Internet
Maintain a Vulnerability Management Program	Use and regularly update anti-virus software on your retail point of sale system Develop and maintain secure point of sale systems and applications
Implement Strong Access Control Measures	Restrict access to cardholder data in your point of sale system Assign a unique ID to each employee with access to the retail software Restrict physical access to cardholder data
Regularly Monitor and Test Networks	Track and monitor all access to the retail point of sale system as well as the cardholder data Regularly test security of your retail software
Maintain an Information Security Policy	Maintain a policy that addresses the security of your retail poin of sale system

Want more information? Download the complete PCI DSS requirements to ensure that your retail point of sale system is fully compliant with PCI DSS.

When talking with different technology vendors about retail software and point of sale systems, be sure to ask about PCI DSS compliance. Not only will staying compliant potentially save you thousands of dollars in fines if your data is compromised, the PCI DSS requirements are all best practices for smart retailers.