You indicated that as of the beginning of 2/1/18 you may not have provided the additional security measure of having multi-factor authentication to your personnel with administrative access to your non-console Cardholder Data Environment (CDE) systems and network. The PCI Data Security Council required the multi-factor security authentication in 2018 so as to minimize the data security breaches that have occurred due to spear phishing of administrators.

You indicated that since February 2018 you made a significant IT change and may not have ensured that all the relevant PCI requirements were in place prior to activation. It is essential that as part of your organization’s change control process that there be sufficient testing such as vulnerability scanning and penetration testing. It is also important that there be clear documentation of the application of PCI requirements.

You indicated that you may not be implementing all of the primary technology tools that are required to safeguard your company from a security breach. Point-to-Point encryption secures against hackers during credit card data transmission.

You indicated that you may not be implementing all of the primary technology tools that are required to safeguard your company from a security breach. Tokenization secures credit card data at rest.

You indicated that you may not be implementing all of the primary technology tools that are required to best safeguard your company from a security breach. Merchants should make the necessary investment in EMV credit card readers for their POS systems to better guard against counterfeit and stolen cards.

You indicated that you either do not, or do not know if you maintain, a properly configured firewall. PCI-DSS rules require merchants to install and maintain a firewall and router configuration to protect cardholder data. Firewall capability is often built into other network devices, such as routers, which control the flow of data into and out of your network. If you do not maintain, or do not know if you maintain a properly configured firewall, consult immediately with a qualified IT professional, ASV or QSA.

You indicated that you may not be implementing all of the primary technology tools that are required to best safeguard your company from a security breach. Merchants should make the necessary investment in EMV credit card readers for their POS systems to better guard against counterfeit and stolen cards.

You indicated that you may not be implementing all of the primary technology tools that are required to best safeguard your company from a security breach. Tokenization best secures data at rest.

By submitting this form you’ll receive assistance and support for all areas of risk. We’ll send you an e-mail with further instructions upon submission below.

You indicated that you may not be covering either Cyber Security best practices or PCI-DSS compliance in your employee handbook. Both the NIST Cyber Security Framework and PCI-DSS rules require organizations to implement strong “access control measures” to ensure that only authorized persons can access sensitive company data. These “access control measures” include limiting access to sensitive company data to only employees whose jobs require such access; assigning unique identification numbers to employees who can access such data; and restricting physical access to systems that contain sensitive company data. Such policies should be adopted and incorporated into an employee handbook that is provided to all employees. If your handbook does not include such policies, consult with an attorney knowledgeable about best Cyber Security polices and PCI-DSS requirements to revise your employee handbook.

Don’t forget to also develop a comprehensive plan within a written Incident Response Plan for rapidly responding to data security incidents.

You indicated that you may be permitting employees to access the Internet from your main, or back of the house computer. While employees doubtlessly appreciate being allowed to go online, check their email, and update their Facebook pages during slow times at work, permitting such access exposes your network to viruses and malware. This is of particular concern when employees use the main computer which collects and transmits sensitive company data. Both the NIST Cyber Security Framework and PCI-DSS rules require organizations to implement strong “access control measures” to ensure that only authorized persons can access sensitive company data. These “access control measures” include limiting access to company and cardholder data to only employees and personnel whose jobs require such access and restricting physical access to systems that contain such data. Restrict access to the main, or back of the house computer to only those vetted personnel who have a business need for using it, and only then if they have a unique password for accessing the system.

Proper Cyber Security practices conform to the PCI-DSS requirement which requires the removal of Secure Sockets Layer SSLv3 security protocols technology and Transport Layer Security TLS v 1.0 past June 30, 2018. Prior to this date, merchants were required to establish a formal PCI-DSS Risk Mitigation Plan to address existing implementations that use SSL and/or early TLS. If you use POS terminals, contact your terminal provider and/or merchant bank to see if their terminals are affected. In non-POS environments e.g. virtual payment terminals, back-office servers, user computers – seek out qualified specialists to obtain upgrades.

Note: Although there had been a prior 2017 European Community Meeting that indicated that the June 30, 2018 deadline was under review by the Council, it is prudent to plan to no longer support these two protocols past that date or have appropriate compensating controls to address the risk.

You indicated you may still be using Windows XP which Microsoft ceased providing security updates for on April 8, 2014. As a result, your data has become unprotected on this old operating system. We understand it is natural to want to save money by hanging onto old equipment. However, the financial risk of keeping Windows XP is much too great. It is necessary to upgrade ASAP.

You indicated that you do not, or do not know if you use updated Anti-Virus software or deploy Patch Management procedures. Both the NIST Cyber Security Framework and PCI-DSS rules require organizations to use and regularly update anti-virus software or programs. The requirements that organizations regularly update anti-virus software and ensure that all software and hardware have the latest security updates (patches) are vital as hackers constantly develop new viruses and malware to exploit vulnerabilities in target organization’s networks. Updated anti-virus software is necessary to recognize and combat these new viruses and malware. If you are uncertain if you use updated anti-virus software and security patches, immediately consult with the individuals or companies who installed your system hardware and software to ensure that the necessary installations are being made to protect your systems.

You indicated that you may not be implementing all of the primary technology tools that are required to best safeguard your company from a security breach. Point-to-Point encryption best secures against hackers during data transmission.

You indicated that you may not be using a Virtual Private Network (VPN) router. A VPN router is a particular type of router that encrypts data, such as customer credit card data, as it passes through a network. Strong Cyber Security practices conform with PCI-DSS rules that require organizations to encrypt sensitive company data and cardholder data as it is transmitted across open, public networks. Use of a VPN router is one way to comply with this requirement. If you do not, or do not know whether you use VPN routers, immediately consult with the individuals or companies who installed your system or credit card processing hardware and software to determine whether it encrypts sensitive company data.

You indicated that you may not be implementing quarterly network scans. Strong Cyber Security practices follow PCI-DSS rules requiring organizations to complete at least four quarterly network scans, performed by an Approved Scanning Vendor (ASV). If you are not engaging the services of an ASV to complete quarterly network scans, you are non-compliant with PCI-DSS requirements and failing to follow strong Cyber Security Practices. Immediately engage the services of an approved ASV to begin completing quarterly networking scans.

You indicated that your organization may not be fully utilizing either email filters or web filters. Filters are required to better ensure that employees will not have unfettered access to the Internet which would pose a grave risk to your organization’s data security. Whereas email filters work with firewalls to act as a first defense to hackers’ phishing attacks, web filters guard against fraudulent or websites whose content is aggregated from other sites. If just one feed of data on a website has been compromised, all the websites that pull in from that feed will provide malware to the user unless web filters have been applied.

You indicated that your organization may not be conducting regular Penetration tests. Penetration tests enable an organization to probe for weaknesses in their own system infrastructure, including hardware and software applications, in order to shore up these network vulnerabilities and develop tighter controls. Penetration tests should play a vital role in any organization’s cybersecurity defenses.

By submitting this form you’ll receive assistance and support for all areas of risk. We’ll send you an e-mail with further instructions upon submission below.

You indicated that your organization may not have required from their Cloud vendor the requisite comfort that their Cloud vendor is applying the highest standards of care in protecting your business data. Many people do not sufficiently understand what Cloud computing does and incorrectly assume that data placed in “the Cloud” is adequately secured. The fact is that the types of security risks (e.g. security, integrity, availability, and performance) that exist in a non-cloud environment are also evident with cloud-based technology solutions. Additionally, Cloud Service Providers (CSPs) are considered to be high value targets by hackers as they contain a consolidation of data from multiple organizations.

You indicated that there may not be an audit log process and tool in place to detect unusual activity on or through your network’s firewalls or routers. As spotting potentially troublesome network traffic activity may be critical to detecting a hacker and time is of the essence, you should work with your qualified IT security specialists to install the right audit log tool and alert controls.

You indicated that you installed a dedicated Internet connection or Wi-Fi network after you configured your firewall but that you have not or do not know if you have reconfigured your firewall since doing so. Merchants’ failure to reconfigure firewalls after the installation of a dedicated Internet connection or Wi-Fi network have led to several high-profile data breaches within the last several years. If you’re not certain that your firewall was properly reconfigured, consult immediately with a qualified expert.

You indicated that your organization may not have taken the precaution of installing Surge Protectors or Uninterruptible Power Supplies (UPS). Although the cause for a power disruption may not have anything to do with data thieves or hackers, a data loss due to an occurrence may have serious consequences for your company. Any comprehensive data protection plan needs to cover this contingency.

You indicated that you may not have an appropriate Data Recovery process which covers the management of full data backups. More organizations have begun to recognize the vital need for backing up important data as a part of a proactive Data Recovery Process. However, organizations should not lose sight of the fact that information on backup tapes or disks are also a common target for data thieves. At a minimum, backup data needs to be locked in a drawer or safe, and don’t forget to secure the backups of employee’s devices that are found on floppy disks, external hard disks, or USB keys. Strong Data Recovery plans require backups to be stored within a very secure offsite location.

You indicated that you may not have prepared an Incident Response Plan in the event of a breach. Although it is hoped that your organization will never experience a security breach, the fact is that companies that do not prepare for such an event most often find themselves ill equipped to adequately manage the devastating aftermath of a security breach. Without a blueprint that provides a coordinated process for how designated company representatives manage customer notifications, law enforcement, media, litigation, remediation, etc, the cost and damages of a breach are made worse.

You indicated that your organization may not have a plan for safely disposing of old computers, printers and media. In addition to the environmental impact of not properly destroying a computer, be aware that deleted or reformatted files stay on a computer and may be overwritten. As such, it is recommended that you use a program that overwrites or wipes the hard drive many times. Alternatively, consider removing the hard drive and physically destroying the magnetic platter inside.

You indicated that your organization may not be adequately protecting the security of its printers. The same security practices for servers and computer workstations need to be applied to printers as they must be maintained in only secure locations and be physically bolted down. Don’t forget about the physical security of documents that employees print out. A simple policy needs to be implemented requiring immediate shredding of all unwanted or extra copies or copies that didn’t print perfectly.

You indicated that your organization may not be doing enough to secure and lock down its servers and server rooms. In terms of pure security precautions, security specialists often recommend rack mounted servers or tower systems. Organizations need to also keep a log book in order to track personnel within the server room in addition to anywhere else where there may be sensitive data. It’s a good investment to have locking devices and authentication systems so that entry doors to server rooms can only be unlocked via a smart card, token, or biometric scan while a record is made of the ID for each person who enters. Surveillance systems are effective and state of the art systems can even be set up to send email or cell phone notification if motion is detected after business hours.

You indicated that there may be a problem with either changing your POS system’s default passwords or not giving employees unique passwords to log into your network wherein these passwords need to be routinely changed at least every 90 days. Both strong Cyber Security practices and PCI-DSS rules require merchants to implement strong access control measures so that only authorized persons can access cardholder data. This includes assigning a unique and complex ID to each employee with computer access which needs to be routinely changed.

PCI-DSS prohibits merchants from using default passwords as VISA has identified the use of default passwords as one of the Top Three POS System Vulnerabilities that lead to data security breaches. Consult with your POS hardware and software providers to ensure that you are not using default passwords on any of your network management devices or remote access applications.

You indicated that you may not have complete policies in place for securing laptops and portable handheld computers within your offices. One simple measure is to ensure that company laptops are to be secured when used in a stationary manner by applying a cable lock. Motion sensing alarms are available as well as software that provide alerts if a stolen laptop or portable computer is connected to the Internet. Keep in mind that all sensitive information needs to be subject to full disk encryption while biometric readers should also be seriously considered.

You indicated that you may not be properly securing computer sites within your organisation. It is a good practice to use computers that have locks to prevent opening its case without a key. It should also be easy enough to simply disconnect or remove computers and disable USB drives that are not being used in empty offices. Even offices that are left empty at lunch or due to an employee’s absence should at least be locked to keep intruders out. As it may be unrealistic to remove computers from open areas, smart card or biometric readers should be considered to prevent unauthorized persons to log onto the computer.

You indicated that your company may be utilizing either third party call centers or suppliers that have access to your IT systems or company data, but questions remain as to whether these third parties are fulfilling both proper Cyber Security practices as well their PCI-DSS responsibilities. Many security breaches have been the result of call centers or supplier vendors that have inadvertently provided hackers an entry point into their customer’s sensitive data systems. It is essential that you only do business with third parties that can demonstrate that they have compliant systems and security practices which can easily be monitored. It also helps to have good contracts with third parties that identify proper Cyber Security practices and PCI-DSS responsibilities upfront and hold third parties accountable for their actions.

As you indicated that your organization may not have BYOD security policies, your organization needs to implement critical data security vulnerabilities associated with employees tapping into sensitive business data while balancing legal regulations and the employee’s privacy. Be sure to seek the help of legal counsel to address privacy issues and liabilities that may emerge when businesses wipe devices after employees leave the organization. It can get tricky when an employee feels that they have ownership of the phone number and thereafter leaves your company to join a competitor. The good news is that there are good policy templates to draw from in developing your BYOD policy and notification protocols to report missing or stolen portable computers. There are also effective security products and tools to check out such as mobile device management (MDM), containerization and app virtualization

You indicated that your company may not have performed adequate training to prevent employees from responding to phishing emails that trick employees into opening links and attachments which contain malware. Basic employee training is critical to avoid employees from inadvertently exposing the company to hackers by improperly using company computers or being deceived by hackers deploying social engineering tricks such as “Phishing”.

You indicated that you may not be restricting access to your company’s critical data to only those employees who have demonstrated a need for access to your company’s critical data and who have been vetted by background checks. Both the NIST Cyber Security Framework and PCI-DSS rules require organizations to implement strong access control measures to ensure that only authorized persons can access such data. This includes physically restricting access to places where hard copy data is stored and where computers or devices that contain such data are available. Implement policies and facility controls to ensure that only authorized persons can access areas where hardcopy or digital data may be available. Be extremely careful in first limiting access to sensitive data to only those select personnel who have a legitimate need to access specific data. Secondly, ensure that each and every individual is properly and thoroughly vetted prior to being granted specific access to sensitive data. Consult your attorney to ensure that background checks may be used properly and in legal compliance pertaining to “authorized” persons provided data access – whether employees, contractors, or vendors.

You indicated that in conducting your self-audit and inventory process that you may have discovered certain fundamental information governance procedures that are not yet in place. Now that you have a better handle on the type of basic deficiencies in how your company is receiving, storing, managing and transmitting sensitive business data, it would be advisable to seek qualified IT/Data Protection specialists to fortify and better secure your data. The Action Plans that track “People”, “Process” and “Technology” solutions will help to better define and give structure to what measures and devices you need to utilize.

You indicated that you may not have taken the critical first step of conducting an internal Data and Systems Audit which would enable your organization to assess the best means to protect your company’s sensitive data and minimize the risk of a security breach. This is not a step that an organization can afford to skip as it lays the foundation to be able to apply best practices for data security.

You indicated that you do not currently have Cyber Insurance coverage. Small and Medium sized businesses are the primary targets of hackers. Most businesses have difficulty absorbing the damage (both financial and to the company’s reputation) associated with experiencing a data security breach. This is why a significant number of small and midsize businesses hit by a cyber-attack will be out of business within six to twelve months. Although it is not a PCI-DSS requirement; it makes good business sense to protect your company with the proper cyber insurance coverage. Make sure that you deal with a reputable insurance agent and that you receive good advice on exactly what coverage you need for your company’s protection.

Retailers use point-of-sale systems to process sale and credit card transactions. A typical POS System consists of three primary components: POS Terminal, POS Server and a POS Operating System. Credit card data flows through this POS Network, from POS Terminal to POS Server to the authenticating source like the bank or credit card processor. Data security vulnerabilities exist at every stage of this process and the best way to protect yourself is with a PCI-Compliant POS system.

You indicated that you installed a DSL line or Wi-Fi network after you configured your firewall but that you have not or do not know if you have reconfigured your firewall since doing so. Merchants’ failure to reconfigure firewalls after the installation of a DSL line or Wi-Fi network have led to several high-profile data breaches within the last several years. If you’re not certain that your firewall was properly reconfigured, consult immediately with a QIR, ASV or QSA.

You indicated that your employees do not have unique passwords to log into your network. PCI-DSS rules require merchants to implement strong “access control measures” to assure that only authorized persons can access cardholder data. This includes assigning a unique ID to each employee with computer access. This ensures that actions are performed by, and can be traced to, known and authorized users. Failure to assign a unique ID to each employee with computer access constitutes a violation of PCI-DSS requirements, and must be remedied immediately.

By submitting this form you’ll receive assistance and support for all areas of risk. We’ll send you an e-mail with further instructions upon submission below.

You indicated that you do not implement, or do not know if you implement quarterly network scans. PCI-DSS rules require all merchants to complete four quarterly network scans, performed by an Approved Scanning Vendor (ASV). If you are not engaging the services of an ASV to complete quarterly network scans, you are non-compliant with PCI-DSS requirements. Immediately engage the services of an approved ASV to begin completing quarterly networking scans.

You indicated that there may be a problem with either changing your POS system’s default passwords or not giving employees unique passwords to log into your network wherein these passwords need to be routinely changed at least every 90 days. PCI-DSS rules require merchants to implement strong access control measures so that only authorized persons can access cardholder data. This includes assigning a unique and complex ID to each employee with computer access which needs to be routinely changed.

PCI-DSS prohibits merchants from using default passwords as VISA has identified the use of default passwords as one of the Top Three POS System Vulnerabilities that lead to data security breaches. Consult with your POS hardware and software providers to assure that you are not using default passwords on any of your network management devices or remote access applications.

You indicated that you use a remote desktop application in your business. Many POS systems come equipped with remote desktop applications that permit business owners to manage their POS systems remotely or permit POS providers to service their systems remotely. A major concern with such remote desktop applications is password security. Too often, default or vendor-supplied passwords are not updated; making POS systems easy targets for hackers. In fact, Visa has identified the use of default passwords as one of the Top Three POS System Vulnerabilities that lead to data security breaches. Consult with your POS hardware and software providers to assure that you are not using inappropriate and unsecure remote desktop applications, you are not using default passwords for those applications, and that you are instead using passwords with strong security credentials. Be aware of PCI-DSS guidance on the proper use of multi-factor authentication (MFA) for preventing unauthorized access to computers and systems that process payment transactions.

You indicated that your company is utilizing either third party call centers or suppliers that have access to your IT systems or customer data, but questions remain as to whether these third parties are fulfilling their PCI responsibilities. Many security breaches have been the result of call centers or supplier vendors that have inadvertently provided hackers an entry point into their customer’s sensitive data systems. It is essential that you only do business with third parties that can demonstrate that they have compliant systems and security practices which can easily be monitored. It also helps to have good contracts with third parties that identify PCI-DSS responsibilities upfront and hold third parties accountable for their actions.

You indicated that you may be permitting employees to access the Internet from your main, or back of the house computer. While employees doubtlessly appreciate being allowed to go online, check their email, and update their Facebook pages during slow times at work, permitting such access exposes your network to viruses and malware. This is of particular concern when employees use the main computer which collects and transmits sensitive company data. Both the NIST Cyber Security Framework and PCI-DSS rules require organizations to implement strong “access control measures” to ensure that only authorized persons can access sensitive company data. These “access control measures” include limiting access to company and cardholder data to only employees and personnel whose jobs require such access and restricting physical access to systems that contain such data. Restrict access to the main, or back of the house computer to only those vetted personnel who have a business need for using it, and only then if they have a unique password for accessing the system.

PCI-DSS requires the removal of Secure Sockets Layer SSLv3 security protocols technology and Transport Layer Security TLS v 1.0 past June 30, 2018. Prior to this date merchants have been required to establish a formal PCI-DSS Risk Mitigation Plan to address existing implementation that use SSL and/or early TLS. If you use POS terminals, contact your terminal provide and/or merchant to see if their terminals are affected. In non-POS environments e.g. virtual payment terminals, back office servers, user computers – seek out qualified specialists to obtain upgrades.

Note: Although there had been a prior 2017 European Community Meeting that indicated that the June 30, 2018 deadline was under review by the Council, it is prudent to plan to no longer support these two protocols past that date or have appropriate compensating controls to address the risk.

You are still using Windows XP which Microsoft ceased providing security updates for on April 8, 2014. As a result your data has become unprotected on this old operating system. We understand it is natural to want to save money by hanging onto old equipment. However, the financial risk of keeping Windows XP is much too great. It is best to upgrade ASAP.

You indicated that you do, or you might, store customer credit card data either electronically or in paper format. The storage of customer card data is a problem that plagues older, or “legacy,” POS systems. Such legacy POS systems may save customer credit card information for longer than commercially necessary (or perhaps even permanently), creating a treasure trove of sensitive information for hackers. Thus, the PCI-DSS Rules prohibit merchants from storing customer card information after a card transaction is authorized. If you think your POS system may be improperly storing customer card data, contact your credit card processor, POS provider, or other qualified IT professional without delay.

You indicated that you maintain a wireless network but that you do not, or do not know whether it is on a separate feed. With the emergence and prevalence of Wi-Fi technology, the PCI Security Standards Council has adopted segmentation for safely maintaining wireless networks. A key concern is “segmenting”, or segregating, cardholder data from other wireless network traffic. Cardholder data must be completely segregated from other network traffic using a firewall or some other means. If you do not know if your wireless network adequately protects cardholder data, immediately consult with the individuals or companies who installed your wireless network to determine whether it properly segregates and protects cardholder data.

You indicated that you either do not maintain, or do not know if you maintain, a properly configured firewall. PCI-DSS rules require merchants to install and maintain a firewall and router configuration to protect cardholder data. Firewall capability is often built into other network devices, such as routers, which control the flow of data into and out of your network. If you do not maintain, or do not know if you maintain a properly configured firewall, consult immediately with a qualified IT professional, ASV or QSA.

You indicated that you do not, or do not know whether you use a Virtual Private Network (VPN) router. A VPN router is a particular type of router that encrypts data, such as customer credit card data, as it passes through a network. PCI-DSS rules require merchants to encrypt cardholder data as it is transmitted across open, public networks. Use of a VPN router is one way to comply with this requirement. If you do not, or do not know whether you use VPN routers, immediately consult with the individuals or companies who installed your credit card processing hardware and software to determine whether it encrypts cardholder data in compliance with PCI-DSS requirements.

You indicated that you are not implementing all of the primary technology tools that are required to best safeguard your company from a security breach. Merchants should make the necessary investment in EMV credit card readers for their POS systems to better guard against counterfeit and stolen cards. Additionally, Point-to-Point Encryption best secures against hackers during card transmission and Tokenization protects the data after transmission.

You indicated that you do not physically restrict access to areas where cardholder data may be available. PCI-DSS rules require merchants to implement strong “access control measures” to assure that only authorized persons can access cardholder data. This includes physically restricting access to places where hardcopy data is stored or where computers or devices that contain such data are available. Implement policies and facility controls to ensure that only authorized persons can access areas where hardcopy or digital cardholder data may be available.

You indicated that you do not cover PCI-DSS compliance in your employee handbook. PCI-DSS rules require merchants to implement strong “access control measures” to assure that only authorized persons can access cardholder data. These “access control measures” include limiting access to cardholder data to employees whose jobs require such access; assigning unique identification numbers to employees who can access cardholder data; and restricting physical access to systems that contain cardholder data. Such policies should be adopted and incorporated into an employee handbook that is provided to all employees. If your handbook does not include such policies, consult with an attorney knowledgeable about PCI-DSS requirements to revise your employee handbook.

Don’t forget to also develop a comprehensive plan within a written Incident Response Plan for rapidly responding to data security incidents.

You indicated that you do not use, or do not know if you use updated Anti-Virus software or deploy Patch Management procedures. PCI-DSS rules require merchants to use and regularly update anti-virus software or programs. The requirements that merchants regularly update anti-virus software and ensure that all software and hardware have the latest security updates (patches) are important as hackers constantly develop new viruses and malware to exploit vulnerabilities in merchants’ networks. Updated anti-virus software is necessary to recognize and combat these new viruses and malware. If you are uncertain if you use updated anti-virus software and security patches, immediately consult with the individuals or companies who installed your credit card processing hardware and software to ensure that the necessary installations are being made to protect your systems.

You indicated that your company has not performed adequate training to help employees from responding to phishing emails that trick employees into opening links and attachments which contain malware. Basic employee training is critical to avoid employees from inadvertently exposing the company to hackers by improperly using company computers or being deceived by hackers employing social engineering tricks such as “Phishing”.

You indicated that you may not presently be conducting background checks on employees who handle or have access to credit card data. PCI -DSS requires that a background screen be performed on any prospective employee (whether full-time, part-time or temporary) as well as contractors and consultants, who will have access to cardholder data or the cardholder data environment.

Background checks are also “recommended” (but not required) for employees who only have access to one card number at a time when facilitating a transaction, such as store cashiers. Although PCI- DSS does not provide a comprehensive checklist of what particular information should be included in such screening , it references that background checks can include verification of previous employment history, criminal record, credit history and reference checks. It is important for the background checks to be completed prior to making a hire and that the background checks be conducted “within the constraints of local laws.”

You indicated that you do not have policies and procedures for dealing with suspected data security breaches. The PCI-DSS rules require merchants to establish, publish, maintain, and disseminate a security policy that addresses all PCI-DSS requirements. Failure to maintain such a policy constitutes a violation of the PCI-DSS rules. Additionally, merchants need to develop protocols for rapidly responding to suspected data security breaches once they occur which are to be contained within an Incident Response Plan. Some state laws require, for example, that merchants notify cardholders when a data security breach occurs, a requirement that, if applicable, should be covered in a merchant’s written protocol. If you do not have such policies or protocols, consult with an attorney familiar with PCI-DSS requirements to develop and implement appropriate procedures.

You indicated that you operate an older POS system. Older systems tend to be more vulnerable to data security breaches for a whole variety of reasons. For example, some older-model POS systems permanently store customer credit card data, creating repositories of sensitive financial data for hackers to steal. Additionally, older model POS systems tend to run outdated operating systems that have not been updated to guard against modern threats, like new types of malware. They say an ounce of prevention is worth a pound of cure, and that is certainly the case when it comes to data security; so protect yourself by upgrading to a newer, PCI-Compliant POS system.

You indicated either that your POS system is not PCI-DSS compliant or that you do not know if your POS system is PCI-DSS compliant. Uncertified systems may adequately serve the needs of your business, but they tend to be more vulnerable to data security breaches. POS security systems need to be regularly upgraded to protect against evolving threats, such as new strains of malware. With uncertified systems, that frequently does not happen. To validate whether your POS system is PCI-compliant, check the registry of service providers maintained by Visa and MasterCard.

You indicated that a non-IT professional installed your POS system. Visa has warned that improperly installed and maintained POS systems increase the risk of data security breaches and, consequently, PCI fines and penalties. Even a PCI-certified POS system can be taken out of compliance, and rendered vulnerable, if it is installed improperly. Approved PCI-DSS vendors can validate whether your POS system is installed properly and in a manner consistent with PCI-DSS requirements.

Visa now mandates that small merchants (Level 4) must use payment solution providers that have achieved Qualified Integrator and Reseller (QIR) certification. Effective 1/31/17, all Level 4 merchants using a Reseller or Integrator for payment applications and/or terminal installation services must retain only a Registered PCI QIR Professional.

You indicated that you either do not, or do not know if you maintain a current support and maintenance plan with your POS provider. Updates or patches to a POS system’s software help maintain its security. POS providers generally provide such updates and patches only to customers who maintain a current support and maintenance plan. Contact your POS system provider to determine whether you maintain a current support and maintenance plan and whether the offered plan includes security features that will protect your POS system from data security breaches.

You indicated that you have not completed the PCI-DSS Self Assessment Questionnaire. All merchants who accept credit cards are required to complete the SAQ on an annual basis. If you have not completed the SAQ, you are currently non-compliant. Information about the SAQ can be found on the PCI Security Standards Council’s website.

You indicated that you do not regularly consult with an Approved Scanning Vendor (ASV), Qualified Security Assessor (QSA), a qualified IT consultant, or PCI attorney regarding your PCI-DSS obligations. This reflects low engagement with, and perhaps violations of, the PCI-DSS rules. Those rules require all merchants to pass four consecutive quarterly scans, performed by an Approved Scanning Vendor (ASV), in order to maintain compliance. If you are not engaging the services of an ASV, you are likely non-compliant. The rules do not require all merchants to engage a Qualified Security Assessor (QSA), but the PCI Security Standards Council recommends that certain merchants, particularly large merchants or those with complex IT environments, consult a QSA to validate their proper implementation of technology and processes. It is also advisable to regularly consult with qualified IT professionals (to verify network security) and a lawyer knowledge about PCI-DSS requirements (to enhance awareness of your contractual and legal obligations).

Visa now mandates that small merchants (Level 4) must use payment solution providers that have achieved Qualified Integrator and Reseller (QIR) certification. Effective 1/31/17, all Level 4 merchants using a Reseller or Integrator for payment applications and/or terminal installation services must retain only a Registered PCI QIR Professional.