PCI DSS

PCI DSS is a set of 12 principal requirements, each with detailed controls and testing procedures, built to protect payment account data and encourage consistent security measures worldwide 1. The standard is written for every entity that stores, processes or transmits cardholder data or sensitive authentication data, or that could affect the security of that data 3. A travel agency that takes card details, whether on paper, by phone, by email or through a web form, falls into that group. Under the standard, once a business stores, processes or transmits the primary account number, a cardholder data environment exists and the requirements apply to it 5.

Whether an agency must formally validate compliance is not set by the standard itself. That is decided by the organisations that run compliance programmes, such as payment brands and acquirers, so the agency should ask its acquirer what is expected 3. Outsourcing payments does not remove responsibility: the agency must still make sure the third party protects the data, and requirements on managing service providers will apply 35.

In practice an agency should:

• Keep stored account data to a minimum, and never keep sensitive authentication data such as the card verification code after authorization, even if encrypted 6.
• Render a stored PAN unreadable 6.
• Avoid sending unprotected PANs by email or instant messaging 8.
• Secure or dispose of paper records that hold card data 5.
• Have an incident response plan, which applies to all entities 5.
• If card data arrives through an unintended channel, either bring that channel into scope and secure it, or delete the data securely and stop the channel being used again 4.

Where local law conflicts with the standard, the law prevails 2.