As the news cycle fills with cases of consumer fraud, compromised data, and “getting hacked,” your reputation as a secure merchant is on the line. Given the barrage of consumer fraud cases being front and center in the minds of your customers, it’s important to know a few best practices when it comes to point of sale compliance.
How PCI DSS Requirements Apply to Your Business
The need for PCI compliance is known to most everyone in the business world. Knowing what exactly PCI DSS requirements apply to your particular business is often more complicated. But achieving PCI compliance is not as difficult as it may seem for business owners. In fact, the wide range of freely available procedural templates makes it relatively easy to identify and correct any PCI compliance issues they may have.
This leaves you in line with the standards established by the major credit and debit card brands, such as MasterCard and Visa, who as part of the Security Standards Council have developed six basic elements that when followed will bring a business into PCI compliance. These key elements are:
- Secure your network and apply software updates and patches, as well as hardware upgrades, as required.
- Protect sensitive data generated by cardholders from being stolen from data repositories and from being intercepted while in transit. This will require end-to-end encryption (E2E) or point-to-point encryption (P2PE) guidelines to be implemented and periodically reviewed.
- Establish strict access controls, as well as a regular access review audit.
- Implement and monitor regular vulnerability scans, for both data on the move and data at rest scenarios, through the use of top of the line antivirus, malware, and encryption software.
- Scan and test your hardware and software devices regularly, even if it means enlisting the help of a security professional.
- Update your information security policy regularly while keeping it accessible and transparent.
These all serve to address a critical element of overall business compliance. However, this alone will not alleviate all of the compliance requirements you may need to meet.
EMV Provides Better Customer Protections
EMV and chip cards are one of the latest payment option trends to walk through the doors of your business. EMV chip cards provide additional layers of security to cardholders while reducing your liability for fraud and compromised card data while in transit. EMV compliance rules went into effect in October 2015, though some businesses were exempt through October 2018. If you are not already EMV compliant and are still only processing cards with magnetic strips, you assume all of the risks for fraudulent charges made on an EMV-enabled chip card that went through your business.
The associated risks of not utilizing EMV technology could cost you thousands in fraudulent charges. This squarely puts the priority to upgrade your business card processing systems to an EMV capable solution. Thankfully, obtaining EMV compliance simply means that you must upgrade your payment processing equipment and software to a solution that can process EMV chip card transactions.
While this may seem inconvenient, this presents a great opportunity to look into your overall POS solution and current support contracts to determine if better options are available. This could help you to kill many regulatory birds with one stone, as many of today’s POS systems are aligned with a bulk of key compliance requirements already included. You gain a hardened security front to provide next-gen security protection for transactions, point of sale reconciliation, and customer data while providing an easier way to align with PA DSS obligations.
Aligning Operational Compliance for Deepened Security
This piece of regulation is perhaps the most overlooked and confusion invoking piece of compliance you will face. PA DSS (Payment Data Security Standards) primary purpose is to make sure that payment apps are secure. While this sounds similar to PCI-DSS requirements, it is not, as PA DSS applies only to vendors of payment applications. But if you don’t fall into this world, why should this be of any concern to you?
The answer to that question includes the selection of your payment processing software. A payment application can only be considered to be compliant to PA DSS standards once certified by a Payment Application Qualified Security Assessor (PA QSA). This, of course, does not necessarily mean that a particular payment application is PCI compliant because it gets the stamp of approval from a PA QSA. In fact, the only true relationship between PA and PCI compliances is that a PA QSA approved application can successfully support the user’s internal PCI DSS compliance program. So where does this leave you in the overall scheme of things regarding PA DSS?
Simply put, while PA DSS certified software may assist your business in some regulatory aspects, it will never bring you to full PCI compliance. For the small business owner, the key component PA DSS provides outside of payment protections are guidelines. Following these guidelines gives you an edge when it comes to achieving PCI compliance in your business. This all combines to give your customers worry-free transactions and a transparent, understandable security policy for you and your staff to follow.
Achieving Point of Sale Compliance Requires Precise Expertise
According to Javelin, card-not-present (CNP) fraud is 81% more likely to occur than POS card fraud, causing financial losses of $6.4 billion in 2018. Javelin also reported that there is a credit card theft incident every 2 seconds in the United States. The wide-scale attack on consumer credit cards can’t be understated. Each credit or debit card transaction is an opportunity for a would-be attacker to obtain transactional data for the purpose of committing fraud. Such incidents, once they strike a business, can be hard to overcome. Trust must be re-established with customers, and financial losses managed.
An effective strategy when it comes to reducing the risks of credit/debit card fraud is to follow a few key point of sale compliance best practices to ensure that applicable regulatory compliances are met. Implementing a new, high-tech POS solution, or upgrading an existing system, are your best defenses against a potential security threat. The complex nature of both developing and maintaining a solid compliance strategy requires additional assistance from a proven partner; a partner that will guide you to a secure, compliant, POS solution that greatly reduces risk.
Maintaining a high level of compliance requires you to seek out distinct expertise in getting your POS solution to a fully hardened state. That’s what talech is here to help you accomplish. We offer a wide range of hardware and software solutions to choose from, and we take the time to address all of your compliance and regulatory questions and needs to deliver a concise solution. Contact us today to sign up for a demo and to learn more about how talech can be your expert POS partner.
