Skip navigation Home Accessibility Statement

Call: +44 (0)1223 550920 Email: info@cashflows.com

Becoming PCI DSS Compliant

To improve security and cut fraud, the card schemes have created a set of Payment Card Industry Data Security Standards (PCI DSS) informing merchants and the payment industry how to securely store, process or transmit card data.

As a merchant you are required to adhere to the PCI DSS requirements for security management, policies, procedures, network architecture, software design and other critical protective measures.

If you are not compliant to the PCI DSS, you will be responsible for any losses through fraud, and will be subject to considerable fines from the card schemes. In addition, your customers will suffer if their card details are compromised and your business' reputation will be seriously damaged.

To become compliant to the PCI DSS, each of your business' profiles must follow the 12 requirements below and then validate your PCI DSS status using a Qualified Security Assessor. You'll need to continuously assess your operations, fix any vulnerabilities that are identified, and always send your latest certificate of compliance to CashFlows.

Please Note: If your business does not provide us with the latest certificate of PCI DSS compliance then you will automatically be enrolled on the CashFlows Compliance Programme.

For more information about PCI DSS, please visit www.pcisecuritystandards.org.

If your business stores, processes or transmits card data, you need to meet the following 12 PCI DSS requirements.

Build and maintain a secure network

Install and maintain a firewall configuration to protect cardholder data.
Do not use vendor-supplied defaults for system passwords and other security parameters.

Protect cardholder data

Protect stored cardholder data.
Encrypt transmission of cardholder data across open, public networks.

Maintain a vulnerability management program

Use and regularly update anti-virus software.
Develop and maintain secure systems and applications.

Implement strong access control measures

Restrict access to cardholder data by business "Need to know".
"Need to know" is when access rights are granted to only the least amount of
data and privileges needed to perform a job.
Assign a unique ID to each person with computer access.
Restrict physical access to cardholder data.

Regularly monitor and test networks

Track and monitor all access to network resources and cardholder data.
Regularly test security systems and processes.

Maintain an information security policy

Maintain a policy that addresses information security.

For further help and advise on any of the above requirements, please read the Understanding the Intent of the Requirements PDF