PCI Compliance: What It Is and Why It Matters


When you boil it all down, PCI (Payment Card Industry) compliance is about doing what is right for your customers and maintaining their trust. Any good business wants to keep its systems secure and safeguard customers’ payment information.

Unfortunately, the process and standards for keeping this sensitive data safe continues to become increasingly complex and require more resources. Keep reading to learn more about PCI compliance and why it is so important for businesses in the restaurant and hospitality industry to be compliant.

What is PCI Compliance?
Any company that processes, stores or transmits payment cardholder data must adhere to a set of standards known as PCI DSS: the Payment Card Industry Data Security Standard.

Cardholder data refers to the personally identifiable information (PII) associated with the owner of a debit, credit, or prepaid payment card. PCI compliance is how the Payment Card Industry Security Standards Council (PCI SSC) ensures merchants handle cardholder data in a secure environment.

What steps must every merchant take to meet PCI compliance?
There are 12 categories of PCI DSS requirements that all merchants must meet to be considered compliant or they risk financial penalties imposed by the card brands. These categories provide a framework comprised of more than 275 questions and requirements and are dependent upon transaction volume as well as the role each party plays in the transaction process. The 12 categories range from encrypting the transmission of cardholder data across open, public networks to assigning a unique ID to each person with computer access.

What are the risks of not being PCI compliant?
PCI DSS is a set of standards, not laws, but almost every state has enacted legislation requiring merchants to notify their customers of security breaches. Current state and federal privacy regulations forbid merchants from storing unencrypted cardholder data, PIN numbers as well as other PII.

Merchants who do not comply with PCI standards risk being subject to costly consequences: fines, legal fees, card replacement costs, forensic audits, decreases in stock equity, reputation damage, and loss of business.

How do third-party payment processors help merchants reach PCI compliance?
Payment processors can help merchants simplify ongoing compliance needs and rest easy knowing they’re meeting all 12 requirements. Hackers are growing smarter and more relentless every day. A third-party processor can reduce a merchant’s risk of exposure and serve as an ongoing security consultant. Processors can identify system vulnerabilities that could be targeted by cybercriminals seeking access to a merchant’s private network. They should also have expert knowledge on the latest compliance rules, as well as a pulse on new and customizable technologies that can decrease or remove a merchant’s system from the scope of PCI compliance.

This is a guest post from Clover Connect, a Tripleseat partner. Clover Connect provides Tripleseat clients with innovative payment security to ensure PCI compliance. With solutions including their patented tokenization and PCI-validated point-to-point encryption (P2PE), Clover Connect ensures that your data is protected and your PCI compliance is better managed. To learn more about this fully integrated solution, visit CloverConnect’s partner page.