PCI Compliance and Your Website: A Guide

Guest post by Ashley Halsey

If you have a website where you sell products or services, you will need to understand PCI compliance to avoid hefty fines for non-compliance. In this article, we will take a look at what PCI compliance is and why you need to know:

PCI Compliance – What Is It?

To increase security for users of debit and credit cards, the Payment Card Industry Data Security Standard (PCI DSS) was founded with the aim that it will look after consumer data and avoid breaches. The rules of PCI compliance must be met by any organisation that accepts credit card payments and meets one of the four levels of compliance. The levels are all based on the total volume of the transactions made through the website over the year, from under twenty thousand right up to over six million.

How Much Does Compliance Cost?

The fee to obtain a compliance certificate is based on the size of your organization and ranges between $1,000 to $50,000 per annum. Whilst this is a high cost, the fines involved with non-compliance are much steeper. On top of this, not complying leaves you open to data breaches and the cost of replacing credit cards that have been scammed.

“It is difficult to give an estimate of total costs without looking at all of the factors, like the cost of building your website, the web hosting cost, software, marketing, maintenance, content and so on,” says Derek Jacobs, an ecommerce writer at Writinity and Researchpapersuk. “What we do know is that you aren’t going to be able to create a website that includes e-commerce for a few hundred pounds. They are much more expensive than normal websites for lots of reasons, particularly because of the compliance and security issues.”

How to Achieve Compliance

There are lots of simple things that you can do to ensure PCI compliance for your website. One recommendation is to install and look after a firewall configuration, and test the systems and processes.

“Treat your passwords like a toothbrush. Don’t let anyone else use them and get new ones every three months,” recommends the PCI Security Standards Council. If your password is still ‘password’, you are asking for trouble. Instead, I recommend using a password generator to build a secure password. Limit sharing of passwords within the organization where you can, and if you have to, store them in an encrypted location.

You should also segment your network environment to effectively isolate cardholder data. As well as this, be sure to encrypt sensitive data that gets transmitted over untrusted networks – or even better, every network.

Install and update the anti-virus software regularly to keep your systems secure. Choosing a PCI compliant hosting provider will achieve these as they can help you out with checking for viruses and managing your antivirus requirements. They can also log and monitor for your audit and security logs.

There are several PCI approved e-commerce platforms which can be integrated into your website and take payments.

When building your e-commerce website, you will want to create an unforgettable experience for your customers that gives them the value they are looking for. You will want to make the payment process secure and smooth, so that the customer doesn’t come up against any road blocks on the way. Although PCI compliance may not be the first priority for your business, if credit card data is breached as a result of people visiting your website, it may damage your brand in a way that is hard to return from.

Ashley Halsey works as a writer for both Edinburgh Writing Service and GumEssays.com. She works on a number of writing and editing projects across Australia. She enjoys traveling, reading and spending time with her two children.