What Is PCI Compliance? Protecting Customer Data and Building Trust

I walk into the same coffee shop every morning. I pay for the same cup of Earl Grey tea and a muffin.

And, every time the barista swipes my card, they’re sending that payment information through a complex ecosystem that maintains the security of my payment details, while also establishing trust between the banks, merchants, and customers.

Part of the ecosystem that keeps payment information safe is called PCI compliance.

PCI compliance, a series of security standards for processing payments and handling credit card information from customers, governs how vendors keep customer data safe from digital threats and even people who work for the company (after all, a CEO could steal data if they have access).

In this article, I’ll explain the ins and outs of PCI compliance. I’ll talk about what you need to know about PCI compliance as a business owner and how it keeps you secure as a consumer.

I like to think about PCI compliance as a playbook that a football coach goes into a game with to not only ensure a win, but to get that win as safely and efficiently as possible. In short, a football coach doesn’t plan on running with the quarterback every play — at the risk of wearing them out or getting injured.

With the PCI DSS playbook, companies have a preset game plan for protecting payment card information. With such a reliable playbook, businesses maintain a fast, efficient payment process while protecting their own infrastructures and the payment information of their customers.

Much like a good football playbook, PCI DSS has layers. It’s designed to develop a solid culture of credit card security for everyone — so businesses never consider it an afterthought, and so customers feel safe shopping online.

Levels of PCI Compliance

With PCI compliance, businesses must follow different levels of security requirements based on the transaction volume they process. In short, you should expect more stringent PCI compliance rules the more business you do online. I’ll talk about the differences in levels below.

Level 1

This level demands the most stringent security rules.

• Pertains to businesses with over six million credit card transactions each year
• Must go through quarterly network scans by a third party
• They also need to go through an on-site security review

The on-site assessment happens every year. Again, Level 1 of PCI compliance involves the most rigorous of security elements, meaning only the largest of enterprise businesses need to worry about it.

Level 2

Level 2 of PCI DSS covers mid-sized to large brands, and it still requires some of the scans and audits from Level 1.

• Pertains to businesses with 1 to 6 million annual transactions
• Must go through quarterly vulnerability scans for the network
• They also need to conduct a self-assessed annual security questionnaire

As you’ll notice, a self-assessment is much less strict when compared to on-site security assessments. There’s also the requirement for “regular reviews of security policies” which, again, is rather general when compared to the specifics of the Level 1 rules.

Level 3

Te average mid-sized company should expect to follow Level 3 PCI DSS.

• Pertains to businesses with 20,000 to 1 million online transactions per year
• Must go through quarterly security scans
• Requires a regular self-assessed questionnaire

Level 3 businesses need to complete regular security protocol updates, too.

I’ve noticed that, as the levels get less strict, you start to see more language like “regular” or “self-assessed,” showing that you still have to complete the requirements, but there aren’t as many specific frequencies or on-site audits.

Level 4

Everyone starts with Level 4 of PCI DSS. Sometimes a fast-growing startup will briefly live in the Level 4 stage and blast off into a much higher transaction range.

You generally only have to worry about Level 4 PCI compliance if you intend on running a very small eCommerce store for the considerable future. For example if your retail shop has a complementary store to boost sales, but it’s not the main focus.

• Pertains to small businesses with fewer than 20,000 online transactions per year
• Requires basic self-assessments
• Must go through quarterly network security scans

In Level 4, the compliance procedures are simplified greatly. Overall, these levels make sense. I wouldn’t expect a small online store to have the same security requirements as a worldwide eCommerce giant like Amazon.

Yet, they still need to go through the basic security procedures to minimize the potential of becoming an easy target.

Importance of PCI Compliance in Web Hosting

When your business signs up for web hosting, it’s crucial to look into the PCI compliance elements that come with that hosting. The basic idea is to ensure the security of customer data, but there’s even more to it.

Here’s why PCI compliance is essential:

1. To keep customers happy and feeling secure, and to actually protect the financial data of customers
2. To prevent any issues with fines and penalties your business may incur due to non-compliance
3. To maintain trust between your business and customers
4. To maintain a certain reputation

In my experience, losing the trust of customers, going through fines due to non-compliance, or damaging your reputation in the industry can take years to repair. Non-compliance could even spell the demise of a business.

In short, businesses must follow PCI standards to stay relevant, to stay legal, to stay trustworthy, and to survive in the business world.

The first time I worked with PCI DSS requirements for web hosting, it felt like I was looking at the blueprints for a 747 aircraft.

But, luckily, I quickly realized I simply needed to break it down into more digestible “key requirements” which turned it into more of a simple, step-by-step recipe for handling payments online. In fact, every safeguard and policy has a very specific purpose.

Technical Safeguards

The technical safeguards that come along with PCI compliance are the locks and surveillance cameras you might find in a bank vault. These safeguards for PCI compliance, however, aren’t quite as visible as the safeguards in a vault. There are several layers, though.

• Secure transmission of cardholder data with SSL/TLS encryption: This is the encryption that scrambles all credit card information while it’s in transfer. This way, the bad guys, even if they gain access to the system, can’t understand what the content actually says. It’s all encoded.
• Regular penetration testing and vulnerability scanning: Penetration testing is when you hireprofessional hackers to try to break into your system to find issues. This is a safeguard to figure out where the weak spots reside. The idea is to fix those security holes before a real thief comes by to take advantage of it.
• Use of intrusion detection systems and firewalls: These are the guards that monitor entrances and exits of your payment processing system, blocking potential bad actors with continual, 24/7 monitoring and scanning.

The idea is for you to find hosting companies that offer all of these elements. They strengthen your PCI compliance efforts by providing multiple layers of protection.

You get strong barriers like firewalls, guards that protect those barriers (intrusion detection), and inspectors (vulnerability scanners) that ensure the walls remain impenetrable.

Data Storage Policies

I find that strong data storage policies are one of the most important parts of an effective PCI compliance effort. This type of protection goes beyond securing the transfer of data. It looks at credit card data at rest (in storage) and prevents intruders from gaining access to it.

Here’s how:

• PCI compliance prohibits the storage of sensitive authentication information after the authorization has occurred
• PCI compliance demands top-tier encryption for all cardholder data stored on a disk

With these two policies, you’re pretty well covered in preventing the leakage of customer credit card data.

Bad actors, for example, can’t access stored data if the authentication information isn’t stored in the first place. There’s also the added layer of encryption for stored data.

Access Control

In my years of working with eCommerce stores and writing about eCommerce platforms, I’ve discovered that access control often serves as the weakest link for security measures.

These access controls may open up sensitive data to someone in your organization who should have never had admin access, or it may leave openings for former/disgruntled employees to steal sensitive data.

I like to take a two-pronged approach when maintaining a solid access control effort for eCommerce stores:

1. Use role-based access control (RBAC) where every worker has very specific access control based on their role
2. Using unique identification numbers for every person with access to your system

Here’s my example of what an effective access control design might look like to maintain PCI compliance:

My example system puts meticulous control over how individuals interact with the infrastructure behind my payment processing system. I don’t want to give anyone more or less access than needed.

For many businesses, web hosting providers give you the vast majority of tools required for PCI compliance. That’s why it’s so important to find the right web host for an online store.

However, you still need to remain diligent, add elements that may be missing for security (particularly if you operate any of your own servers), and be sure to turn on and manage certain features that make your business and website more PCI-compliant.

The Shared Responsibility Model

Handling PCI compliance alongside your hosting provider is like renting an apartment. The landlord (your hosting provider) is responsible for installing security cameras, removing dangerous elements like ice or rickety stairs, and making sure the units remain clean and clear of contaminants.

However, the tenant still has the responsibility of protecting their individual units. The shared responsibility model basically means that, for PCI compliance, hosting providers and merchants both have responsibilities for keeping transactions, and the storage of credit card data, secure.

It also means that you should never assume that the hosting provider will handle every aspect of PCI compliance. Ensuring your hosting company follows PCI compliance standards is only the first step.

What Should You Look for in PCI-Compliant Hosting Providers?

I recommend thinking about PCI-compliant hosting providers like you would a bank. You’re storing money and valuables with a bank, while the hosting provider protects the payment systems of your business and the payment credentials of your customers.

Therefore, you should seek hosting providers with secure data centers and server environments. Beyond that, you should also ensure the hosting provider offers managed services to maintain compliance with as little work on your end as possible.

Questions to Ask a Hosting Provider:

• Do you, as the hosting provider, undergo PCI compliance audits regularly?
• What are the tools and resources used to meet PCI DSS requirements?
• Which parts of PCI compliance are left for me, the business owner, to handle?

When speaking with a hosting provider, think of it like a job interview. Hammer them with questions to figure out if it’s exactly what you need to remain compliant. If you have trouble finding someone on the support team to answer these questions, move on immediately.

Although the basic idea of PCI compliance is to protect payment details, it’s also great for building a complete fortress around your entire online presence. From gaining customer trust to improving your legal protection, there’s a wide range of benefits after achieving PCI compliance.

If I’m totally honest — although there are streamlined ways of achieving compliance — PCI DSS is not without its challenges.

I’d argue that the average business needs to spend a significant amount of time to learn about PCI compliance, and to keep their web hosting company in check with the requirements.

My recommendation is to prepare for the challenges. This way, you’re ready with a plan when they arise.

Greater Complexity

I’ve mentioned complexity before. PCI compliance seems so incredibly intimidating. But that’s somewhat deceptive.

Whenever I break it down into a simpler article (like this one), most people have a much easier time understanding how to approach PCI DSS.

So, do your best to follow along with this guide, and do your homework on a solid, PCI-compliant hosting company to simplify the entire process.

Balancing Security and User Experience

The greatest challenge I’ve encountered with PCI compliance is the balancing act between security and user experience. For instance, you’ll want to maintain adequate user roles without hindering access to necessary resources.

You also want to avoid slowdowns on your websites, particularly in the crucial area of the checkout module, where people are far more likely to leave your website if they think it takes too long.

Maintaining PCI Compliance

Cyber threats change. I hear about new ones every year. From DDoS attacks to malware, you must stay in the know about which cyber threats could cause issues with your payment processing and PCI compliance.

To maintain PCI compliance with those ever-evolving threats, it’s important to complete regular updates to your software and hosting.

As someone who has helped many brands with PCI compliance, I’ve stumbled upon so many challenges. Those struggles, however, have helped me develop a set of tips and best practices for the smoothest PCI compliance process possible.

• Patch and update your software and systems regularly: You must maintain a quality hosting and software environment for the best security. Think of it like changing the oil in your car and running it through an annual tune-up. You’re better off making small changes and improvements now instead of having to deal with a major engine problem thanks to the neglect. Patches and updates fill security holes and improve security all around.
• Pick a PCI-compliant hosting provider: A PCI-compliant host follows PCI DSS requirements to the letter. You should interview each host you intend on using, and figure out how they maintain PCI compliance for online stores and other payment processors. You’ll want a managed environment so that you have the right level of PCI compliance, along with the appropriate audits and tests needed for finding vulnerabilities.
• Train your staff on compliance requirements and security best practices: Along with solid access controls and a PCI-compliant host, you’ll want to train your workers on PCI compliance and data security in general. They’re your first line of defense and come in handy for both maintaining a secure environment on the website, but also for identifying security threats you may have missed.

With a well-trained staff, PCI-compliant host, and updated software, you’re well on your way to an online payment system that follows PCI DSS rules. Those are the three main components to keep your site secure and customers happy.

I’ve seen the requirements from PCI DSS evolve over the years. I love how it’s much easier for merchants to become PCI-compliant, all thanks to hosting companies that offer PCI support.

I’m here to tell you that you should not get intimidated by the process of PCI compliance because it’s not only required by law in most jurisdictions, but it’s actually not as tricky as it initially seems to understand.

And your business will thank you for following PCI standards. These regulations help you maintain a forward-thinking security infrastructure, one that strengthens various parts of your online presence without too much extra investment.

All it takes is choosing the right hosting provider. Good luck in your journey with PCI compliance.