When you think about all the customer data that the average retailer has to keep secure, it could feel overwhelming: Names, addresses, dates of birth, Social Security numbers, bank account numbers and, of course, credit card numbers.
Historically Payment Card Industry Data Security Standard (PCI DSS) has been focused on the large and big-box merchants, sometimes known as the "Level 1" businesses. But as their hands were forced to implement more mature security, the threats moved on as well.
Nowadays and perhaps contrary to conventional wisdom, it is actually the pizza restaurant down the street - not the massive department store chain - that is facing the most immediate data security threats. Small and midsize businesses, which typically fall into Level 4 of PCI DSS, are quite vulnerable to hackers and fraudsters, partly because their IT environments are easy to intrude upon. Add to this the fact that many of these merchants work with third-party service providers, which themselves are not practicing good security hygiene, and the losses can add up fairly quickly.
To protect and maintain the integrity of the payment network as a whole, the card brands have created and evolved their own security programs. Specific to the security of mom-and-pop shops, Visa late last year established new requirements for U.S. and Canadian acquirers that provide payment card processing accounts to these merchants. The new mandates take effect Tuesday.
- Effective Jan. 31, acquirers must ensure that Level 4 merchants using third parties for point-of-sale (POS) application and terminal installation and integration engage only PCI-qualified integrator and/or reseller professionals (QIR).
-
- Effective Jan. 31, acquirers must ensure Level 4 merchants annually validate PCI DSS compliance or participate in the Visa Technology Innovation Program (TIP).
There are some exceptions to these requirements, namely that single-use terminal merchants without internet connectivity are considered low risk and therefore excluded.
But what this means for most other Level 4 merchants, and really any merchant, is that there is an increased focus on ensuring data security and working with secure partners.
It is worth noting that Visa is offering relief from compliance validation for those merchants that have invested in secure payment technologies, specifically EMV-compliant hardware and/or PCI-validated point-to-point encryption solutions.
We strongly encourage all merchants and payment card-accepting entities to double down on their security efforts and attest to compliance with PCI DSS. And for those that work with third parties on managing or installing their POS systems, only consider a certified PCI QIR professional.
Finally, acquirers should be aware that reporting on compliance for Level 4 merchants is going to be the new norm. We would encourage all acquirers and merchant service providers to ensure they have a PCI compliance program in place for their merchant portfolios.
James Zou is a systems engineer at Trustwave specializing in PCI DSS compliance.
