An Overview of PCI DSS Compliance and Certification in India

Card data is one of the hottest assets being targeted in India, given the digital payments revolution in the country. UPI, cards, wallets, and payment gateways handle billions of transactions per month, and all businesses that come into contact with it should ensure that they are safe. A PCI Compliance Assessment is the first step to understanding how your business is doing and what needs to be addressed before it is your auditor, bank, or attacker that discovers it is missing.

What Is PCI DSS?

The PCI Security Standards Council (PCI SSC) has developed the Payment Card Industry Data Security Standard (PCI DSS), which is a worldwide security standard. It covers any organization that stores, processes, or transmits cardholder data. The latest is PCI DSS v4.0.1, which now enforces all its requirements.

There are twelve requirements presented in six goals that form the standard:

• Build and maintain a secure network and systems
• Protect account data
• Continue to run a vulnerability management program.
• Implement strong access control measures
• Frequently monitor and test networks. Test and monitor networks regularly.
• Keep an up-to-date information security policy

Why PCI DSS is important for businesses in India.

The regulators, acquiring banks, and card networks in India are responsible for compliance—not a single law. Payment aggregators, gateways, and banks are also expected to comply with PCI DSS by the RBI, and it's a requirement for the acquirers to regularly ask merchants to comply with the standards.

• Regulatory pressure: With RBI's payment aggregator and data storage guidelines, entities are pushing to secure card information.
• Customer trust: Customers don't enter their card information with brands that they don't trust.
• The cost of a breach is much higher than the cost of compliance: Fines, Forensic investigations, Card reissuance, and lost customers.
• Market access: Enterprise and international partners may require proof of compliance before they’ll sign contracts.

The goal is to understand PCI DSS Certification in India.The overall objective is to know about PCI DSS Certification in India.

People often refer to the PCI DSS certification in India; however, the PCI SSC does not issue certificates. Businesses get a validated Attestation of Compliance (AoC) with a Report on Compliance (ROC) or a Self-Assessment Questionnaire (SAQ). The route you take depends upon your merchant/service provider level—determined by transaction volume and by the brands of the card.

• Level 1: Typically over 6 million card transactions a year. Must have annual Qualified Security Assessor (QSA) and quarterly network scans.
• Level 2 and 3: Moderate sounds. Typically provide an SAQ, along with scans from an Approved Scanning Vendor (ASV).
• Level 4: Smaller merchants. In most cases, use an SAQ, but there may be other conditions imposed by the acquirers.
• Service providers: Payment gateways, hosting companies, and processors have their own rules for validation, which may be harder than the rules of merchants.

Actually, you should always check with your specific acquiring bank what the exact level and validation requirement will be, as it may be different from that outlined above.

What a PCI Compliance Assessment entails

A PCI Compliance Assessment compares the current controls in place to all applicable PCI DSS requirements. When executed properly, it can replace the guesswork with a definite plan for remediation, prioritized in a logical sequence.

Define the Scope

Trace all systems, applications, network segments, and individuals that have contact with (or access to) cardholder data. The No. 1 cost driver is Scope and the sooner it is reduced via network segmentation, tokenization or outsourcing to a compliant gateway, the sooner it pays off.

Run a Gap Analysis

Review current controls and PCI DSS. Common results are poorly enforced access control, out-of-date systems, lack of logs, outdated encryption, and undocumented policies.

Remediate

Plug the holes (in priority order). It typically involves multi-factor authentication, more robust encryption, firewall rule reviews, centralized logging and staff training in security awareness.

Validate and Attest

Fill out the AoC, submit results of the ASV scan(s) as needed, and sign the ROC or SAQ. The evidence is then examined by your acquirer or card brand.

Maintain Compliance

PCI DSS is not a project that is done and dusted. Validation once a year, scans every quarter, penetration testing periodically and continuous monitoring ensure compliance between audits.

The common challenges faced by businesses are:

• Unnecessary storage of card data - card data stored in spreadsheets, emails, old databases, etc.
• Lack of Scope that adds to audit effort and cost.
• Lacking in-house skills and 24×7 security monitoring capacity
• Viewing compliance as an annual process rather than a continuous process
• Dealing with more stringent authentication, log and risk analysis requirements of v4.0.1

Are You and Your Business Ready?

This can be answered by a quick readiness check. Ask yourself the following questions: Do you know where your cardholder data is stored? Is it encrypted even when it's stored? Is access to cardholder data limited and monitored? Do you have systems that are patched and scanned regularly? Do you have documented security policies that are adhered to? If you are not sure of your answer, then you should proceed to a formal PCI Compliance Assessment..

Final Thoughts

In this rapidly evolving digital landscape in India, PCI DSS compliance not only safeguards your customers' data but also helps maintain your reputation and trustworthiness when accepting card payments. Identify a clear assessment, limit scope, mitigate gaps early, and consider security an ongoing process. Those companies that do are spending less on auditing, are less likely to experience incidents, and are more likely to gain trust.

Businesses around India and 15+ countries are turning to Cloud Patrons Info Solutions to help them become and stay PCI DSS compliant. Our staff can help you get to your successful PCI Compliance Assessment easier and at a lower cost through gap analysis, remediation support, 24x7 NOC and SOC monitoring, and more. Talk to Cloud Patrons now to ensure you're prepared and protected for payments.

Cloud Patrons can provide you with end-to-end PCI DSS compliance services – from assessment / gap analysis to remediation / 24×7 security monitoring. Go to cloudpatrons.com for details on how their team can make your business audit ready.