Click here for a video that explains the risk of non-PCI compliance
Background on PCI & Credit Card Security
For many years now, both restaurant owners and their diners have been enjoying the convenience of accepting and using credit and debit cards. However, given the high and rapid increase cost and frequency of credit fraud, the major card brands such as Visa, MasterCard, American Express, Discover and JCB have taken steps to safeguard all stakeholders.
IBM invented the magnetic stripe on credit cards in 1968 and became the industry standard. Since the track data is easy to read and duplicate on the mag stripe, the card brands, the Payment Card Industry (PCI) Security Standards Council built a set of standards protect cardholder data, and it begins with the directive: ‘Don’t store track data.’
The Payment Card Industry (PCI) Standards
The three-pronged approach that the PCI Security Standards Council took to protect consumers, merchants/restaurateurs and banks:
- Payment Card Industry Data Security Standard or PCI DSS ‐ covers all entities that store, process, or transmit cardholder data: Merchants, restaurateurs, service providers, processors, etc.
Deadline for Compliance: Month of January 2007 (deadlines are long passed)
What it Means – All restaurateurs (in spite of size) is required to complete and submit a PCI Self-Assessment Questionnaire annually to their Acquiring Bank.
- Payment Application Data Security Standard or PA-DSS ‐ involves all applications used to store, process, or transmit cardholder data as part of authorization or settlement. (Point of Sale (POS) application developers)
Deadlines for Compliance:
Oct. 1, 2008 ‐ Only the software that is compliant with the new payment application security standards must be used by agents, merchants and payment processors.
Oct. 1, 2009 ‐ All merchants will be required to start terminating the use of any non-compliant payment applications that they might still have in their environments.
July 1, 2010 ‐ Mandates the use of only those payment applications that support the new standards.
What this Means – After these deadlines, merchants/restaurateurs that are still using a non-PA DSS-validated application, they automatically fail the PCI assessment and will lose their ability to accept credit cards.
- Pin Entry Devices (PED) Standard – covers all PEDs and is aimed at ensuring that the cardholder’s PIN, including any sensitive information such as resident keys, are protected consistently at a PIN acceptance device.
Deadline for Compliance:
Jan. 1, 2004 ‐ All newly purchased Point-of-Sale (POS) PIN Entry Devices must have passed testing by a Visa recognized laboratory and been approved by Visa.
July 1, 2010 ‐ Mandates that every POS PEDs must pass and get approved by PCI SSC from one of its recognized laboratories.
What this Means ‐ Merchants/restaurant owners have 2 years to replace older, un-approved PEDs.
The Do’s With Payment Card Industry (PCI)
- Make sure you have a routine vulnerability scan for your POS systems.
- You must do a security awareness training for your staff.
- Make system access audits.
- System activity logs should be monitored.
- Access privileges must be removed for separated employees.
- Do install software patches.
- When it comes to any threats, be serious – have an incident response plan in place.
The Don’ts of Payment Card Industry (PCI)
- Whole credit card numbers should not be stored or archived.
- Don’t transmit credit card information unencrypted.
- With PCI, it is not about making you compliant with the standards – it’s about keeping you and your customers protected.
PCI’s Effect on Restaurateurs
Given consumers’ expectation of omnipresent acceptance of credit and debit cards, restaurateurs’ validation that they are protecting their customers’ personal information is good for business:
Reputation / Image
In any competitive business – a restaurateur does not want to be named in the media as the place were card data was stolen.
Protects Ability to Accept Credit / Debit Card Payments – neglecting the rules and/or a breach can jeopardize a restaurateur’s ability to accept credit/debit payments. In many cases, credit/debit payments account for 80% to 90% of transactions. Losing your restaurant’s ability to accept credit/debit cards can reduce your customers.
The Effects of State Privacy Laws
A breach that discloses individual’s credit card info with any of the 40+ States governed by the privacy laws may experience double impact on the side of the merchant/restaurateur. Being off-side with the Payment Card Industry will result in fines and litigation costs. Being off-side with State Privacy Laws is a criminal action with potentially more serious consequences.
Complying / Security Strategy
- By making sure you’re using only PA‐DSS or PABP validated POS systems
- Ensuring that you use approved PEDs
- Have regular security awareness training for your staff – particularly supervisors
- Do background checks on anyone that has administrative access to your system
- Have your staff sign a ‘Confidentiality Agreement’
- If you’re not sure how to complete the PCI Self Assessment Questionnaire (SAQ), you can always ask
- If you experience gaps in the PCI compliance, develop a realistic plan to straighten it out
- Maintain mature controls to sustain compliance
- Always have double factor for system and device management
- Strong passwords and secure password storage
- Keep monitoring system activities for potential attacks and record evidences
- Controlling your wireless access points
- Maintain secure configuration
- Maintain an Incident Response Plan and Test It
- Testing and auditing the cardholder environment
It may be a discouraging task on your first try but when everything else is in place, ongoing PCI compliance is not an expensive undertaking. Besides, it’s a good practice for businesses to protect the sensitive information that your customers entrust with you.
Do You Have Any Questions?
For more information and advice on this topic you can quickly contact a Restaurant POS professional serving your area at www.POS-For-Restaurants.com
The author of this article writes for POS-For-Restaurants.com – a VP of Customer Relations with over 20 years experience in the restaurant point of sale industry.