|
The Payment Card Industry Data Security Standard (PCI:
DSS) has been introduced in a bid to secure cardholder data. PCI secures cardholder
data that is stored, processed or transmitted by merchants and processors. The standard
specifies 12 requirements for security, technology and business processes, and reflects
most of the usual best practices for securing sensitive information.
If organisations choose to ignore meeting the requirements
of PCI: DSS they will ultimately pay the penalty. Failure to comply is likely to
result in hefty fines, along with the potential of increased fraud. The harsh reality
is that the onus is on retailers to comply with the legislation and it is the retailers
who face the cost of non compliance – not their suppliers.
The process to compliance can be an arduous and drawn
out process. Retailers have to build and maintain a secure network, which protects
cardholder data. Companies need to track and monitor all access to network resources
and cardholder data and regularly test security systems and processes. Most importantly,
the business needs to maintain a policy that addresses information security.
This leaves retailers with a choice. They can either
manage the process of PCI: DSS in-house or they can outsource to a payment services
provider.
If retailers choose to keep compliance in-house they
may face high costs and issues that could be avoided. There are costs associated
in securing stored cardholder data and also in monitoring systems containing the
data. Organisations must also bear in mind security management costs, such as transmitting
the cardholder information. Retailers must also consider the ‘time to compliance'
which can take much longer when they are not in the hands of an expert.
Often the handling of financial data can be haphazard
at best and putting bad processes right will take time. Also the high demand for
IT resources means the salaries of compliance and security experts are high. However,
if a retailer chooses to work with a payment services provider which already has
PCI experience and pre-compliance, these problems are eradicated.
This is even more crucial at a time when the economy
is unstable. It is important that retailers are able to concentrate on what they
are good at – selling and marketing their goods to consumers, not concerning themselves
with technical issues that add no value to the bottom line.
However, there is an alternative for retailers who don't
want to go through time consuming PCI accreditation themselves. Many businesses
have taken the decision to outsource their PCI accreditation to a specialist payment
services provider who can offer a fully PCI compliant service. By doing this retailers
will avoid full PCI audits and acquirer certification. This means that a retailer
faces significantly reduced compliance costs to secure cardholder data.
Outsourcing also eliminates costs and security problems
associated with running in-house systems. If a retailer decides to outsource services
they will see a much shorter time to compliance. Overall compliance costs can be
reduced by as much as 65% in some cases and retailers need not worry about maintaining
a policy that addresses information security as it is in the hands of the payment
services provider.
The incentive for working with YESpay as your outsourced
payment services provider who can manage the whole process for you is a simple one
– companies reduce costs to a minimum and protect their long term business plans.
By putting compliance demands under the tutelage of an expert it safeguards both
a retailer's business and its customer data, which gives businesses the time to
concentrate on the day-to-day business.
|