By John Kindervag
"…to need to be compliant." I have heard this statement from many clients. This is a common and broad misunderstanding of the requirements. While there are various levels of credit card merchant and service providers, there is no difference in compliance requirements. The fundamental confusion is between compliance and validation. PCI requires that any entity that stores, processes or transmits any credit card data to be in compliance with the PCI Data Security Standard. The amount of validation is the real differentiator.
Additionally, PCI assumes that each covered entity is always fully in compliance with PCI. I hear customers say that they must be compliant by such and such a date. That is wrong. What they need to understand is that they are assumed to be compliant right now, and there may be a date that they have to be validated as compliant. The fundamental difference between Level 1 and Level 4 PCI requirements is only regarding the amount of third-party validation that must be done to meet the certification process.
Any entity that takes credit cards takes enough credit cards to need to be compliant with PCI. The number of credit card transactions determines the level of validation, not compliance.
About the author
Five myths of PCI compliance
Introduction to the myths of PCI compliance
Myth 1: PCI is hard
Myth 2: PCI will make us secure
Myth 3: Encryption is scary
Myth 4: "I don't take enough credit cards…"
Myth 5: Product X will make me compliant
John Kindervag is a 20-year veteran of the high-technology world. He is the senior security architect for Vigilar Inc., where he helps corporations design secure networks and manages Vigilar's Vulnerability Assessment and Compliance Practice. Kindervag holds a Bachelor of Arts degree in Communications from the University of Iowa.
This was first published in August 2007