Debit and credit card information is at a higher risk than ever. From 2019 to 2020, identity theft by credit card fraud increased by 44.6%.
Unfortunately, many companies aren’t securing this information as well as they should. Only 27.9% of companies were compliant with the Payment Card Industry Data Security Standard (PCI DSS) in 2020.
What Is PCI DSS?
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards that protects debit and credit cardholders from fraud.
PCI DSS was created in 2004 by the Payment Card Industry (PCI) Security Standards Council (SSC). The PCI SSC founding members were American Express, Discover Financial Services, JCB International, Mastercard and Visa.
PCI DSS protects cardholders’ account numbers, names, expiration dates and card verification values (CVV).
Who Has to Be PCI Compliant?
PCI DSS applies to all merchants who accept credit cards and other payment processing organizations. Because PCI DSS isn’t a law, your business might not need to be compliant.
Your company needs to be PCI DSS compliant if:
- Your company signed a contract with a credit card company as a merchant, or
- Your state added some of PCI DSS to its laws
MFT Features that Help with PCI Compliance
There are 6 goals and 12 requirements of PCI DSS:
| Goals | Requirements |
|---|---|
| Build and maintain a secure network | 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor-supplied defaults for system passwords and other security parameters |
| Protect cardholder data | 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open, public networks |
| Maintain a vulnerability management program | 5. Use and regularly update antivirus software or programs 6. Develop and maintain secure systems and applications |
| Implement strong access control measures | 7. Restrict access to cardholder data by business need-to-know 8. Assign a unique ID to each person with computer access 9. Restrict physical access to cardholder data |
| Regularly monitor and test networks | 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes |
| Maintain an information security policy | 12. Maintain a policy that addresses information security for employees and contractors |
Managed file transfer (MFT) solutions secure file transfers to help companies achieve compliance.
Here are the PCI DSS goals matched with MFT features that support them:
- Build and maintain a secure network.
- Protect cardholder data.
- Maintain a vulnerability management program.
- Implement strong access control measures.
- Regularly monitor and test networks.
- Maintain a policy that addresses information security for employees and contractors.
MFT solutions should use firewalls and require IP address whitelisting to protect against brute force attacks.
By encrypting files in transit and at rest, MFT solutions keep cardholder information safe. They also should have retention policies to archive or purge files after a certain time period.
MFT solutions should scan every file for viruses and have multiple application security measures in place to keep unauthorized users out.
MFT solutions should have strong user authentication, including support for two-factor authentication. They should also require endpoint authentication with a password or key.
Role-based access controls in MFT solutions help administrators limit access according to the security principle of least privilege.
MFT solutions should track all file transfers and user actions. They should support email and text alerts in case a file transfer fails or no files are received.
Companies can require employees to use an MFT solution in their information security policies to protect confidential employee and customer data.
Move Closer to Full Compliance
The risk of data theft and fraud has been increasing – how do you protect your customers?
We can help. Thru, our cloud managed file transfer (MFT) solution, has many features that help your company achieve compliance, including:
- Encryption in transit and at rest
- PGP encryption and signing
- Role-based access controls
- Multi-level retention policies
Learn more about Thru’s secure file transfer and compliance »
To read our complete policy documentation, go to our Trust Center »
25 Credit Card Fraud Statistics To Know in 2021 + 5 Steps for Reporting Fraud
Payment Security Report
