PCI COMPLIANCE

The card associations have implemented mandatory Payment Card Industry (PCI) Data Security Standards as a result of continuing fraud. These standards impact all merchants. Any merchant may be required to meet the minimum standards as set forth by the associations. E-commerce merchants processing 20,000 transactions or more in a 12-month period must complete self-assessment questionnaires and quarterly scans. Failure to fully comply with the requirements can result in fines and enhance compliance levels. The terms and conditions of your merchant agreement require you to fully comply with all card association regulations.

The following is more in-depth information from Visa.com. For additional information related to PCI, please visit the associations' websites at https://sdp.mastercardintl.com or www.visa.com/cisp.

CISP Compliance

CISP compliance is required of all merchants and service providers that store, process, or transmit Visa cardholder data and applies to all payment channels, including retail (brick-and-mortar), mail/telephone order, and e-commerce. Compliance with CISP means compliance with the PCI Data Security Standard with the required program validation.

The Payment Card Industry (PCI) Data Security Standard offers a single approach to safeguarding sensitive data for all card brands. Other card companies operating in the U.S. have also endorsed the PCI Data Security Standard within their respective programs. Using the PCI Data Security Standard as its framework, CISP provides the tools and measurements needed to protect against cardholder data exposure and compromise. The PCI Data Security Standard consists of twelve basic requirements, categorized as follows:

PCI Data Security Standard
Build and Maintain a Secure Network	Install and maintain a firewall configuration to protect data Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data	Protect stored data Encrypt transmission of cardholder data and sensitive information across public networks
Maintain a Vulnerability Management Program	Use and regularly update anti-virus software Develop and maintain secure systems and applications
Implement Strong Access Control Measures	Restrict access to data by business need-to-know Assign a unique ID to each person with computer access Restrict physical access to cardholder data
Regularly Monitor and Test Networks	Track and monitor all access to network resources and cardholder data Regularly test security systems and processes
Maintain an Information Security Policy	Maintain a policy that addresses information security

By complying with the PCI Data Security Standard, Visa members, merchants, and service providers not only meet their obligations to the payment system, but also build a culture of security that benefits everyone. If you have any questions regarding PCI compliance, please contact our 24-hour customer service line at 800-789-8897. In the event of a data security breach, the Compliance Department must be notified immediately at 817-317-9100 ex.1592.