So few people I meet who are trading online, particularly in small and medium-sized companies, seem to understand the implications of becoming – and more importantly, staying – PCI compliant. When discussing requirements with my clients, the first question I’m usually asked is, ‘what is PCI compliance?’

The term refers to the Data Security Standard set by the Payment Card Industry and the details can be found in full at www.pcisecuritystandards.org. In précis, the standard is concerned with ensuring that customer data – particularly credit card data – is held securely. The standard is so strict that, in fact, the solution is to completely avoid holding credit card details. Fortunately, many of the better third-party payment gateways such as SagePay have made this a viable option for e-commerce, if not for telesales.

A reasonable question following from this, then, is why is the standard so strict? Despite my minor gripes about the standard, which I’ll come to shortly, there’s no question that there were an increasing amount of e-commerce sites on the web that were not built to any standard security measures. Many of these were – and still are – holding unencrypted credit card details, making customers’ card details incredibly vulnerable to hackers and creating the myth that online payments weren’t as safe as those made in person. The payment card industry took it upon itself to set the standard, and rightly so.

So, if you are processing credit cards online, a good question to ask is, ‘when do I have to become PCI compliant?’ The answer is that you already should be. It may appear to be relatively easy to trade online without being PCI compliant and, if you are ‘caught’, you will usually receive a reasonable period in which to achieve compliancy. But matters become far more serious if your security is breached and credit card details are stolen. The fines are punitive and your company will then be under constant scrutiny, with expensive top level compliance required.

Anyone trading online is affected by the standard, so no one should be kidding themselves that they are in any way exempt. The banks have written to their merchant clients telling them of the need to be compliant, so I anticipate that there can only be a relatively small percentage of online traders who are genuinely unaware of the requirements around compliancy.

The 64 million dollar question, then, is how to achieve compliancy? If you are holding credit card details and intend to carry on doing so, then there are some big hurdles to jump. Just download the certification documentation from the PCI site and you will see just how extensive the requirements are. If, however, you use one of the better payment gateways, such as SagePay, there are ways around holding credit card details, even in complex situations involving delayed charging (such as when an order is shipped in multiple parts). Not holding card details makes achieving compliance a lot easier.

So, the first step is to ask whether you currently hold credit card details. If the answer is no and you are already trading online, then you should just need to self-certify yourself using the documentation from PCI which you can download. You can then use a company such as Security Metrics to scan your site quarterly and confirm your compliancy.

The second scenario is that you do hold credit card details and want to continue to do so. This is the worst case scenario (from a PCI point of view) and self-certification won’t be an option. You will need to demonstrate exactly how the card details are held, who has access to them and what security you have in place. You will need to read the full PCI documentation to understand what you need to do.

If you are holding credit card details but don’t need to then, with a bit of work, compliance should be easy to achieve, albeit with a bit of development work. The easiest solution is to process the payments ‘off site’, so your customer is taken to the payment gateway’s pages. Once that’s done, all you need to do is to delete the cards you’re holding from previous transactions.

If you want to look that bit more professional and process the card payments on your own site – which is what we recommend – then you still don’t need to save the card details: you simply pass them “invisibly” from your site to the payment gateway. You don’t have to take payment straight way – if you want to wait until you ship the goods for example – you can just get a token which can be ‘cashed in’ when the time comes.

Moving forward, educating customers to stop them using sites that don’t demonstrate certification would encourage e-commerce sites to adopt a proper level of security. It would also avoid naive companies – who, perhaps, have not been properly advised by their web provider – incurring large, unexpected fines when their sites are hacked.

There’s little doubt in my mind that the standard is flawed, and the fact that the banks appear to have followed the PCI slavishly hasn’t helped. Although we at Meantime don’t trade online, we’ve achieved PCI compliance as a company, as well as building e-commerce sites that are compliant. This was very difficult, unnecessarily so, and, in places, the requirements were illogical. However, PCI is the standard and that is what we have had to follow. All e-commerce companies need to follow suit.

Related Articles