Nothing is more important than the security of your business and the security of your clients. The ability to keep your sensitive business information secure can be a make-it-or-break-it circumstance. Implementing a security protocol gains your clients trust and keeps your business operating knowing it is doing what it can to protect its assets.
Data security doesn’t just strengthen your internal functions but visibly proving that you are secure has statistically increased conversions from 8-12% than those without it. Below are some do’s and don’ts of PCI security that will make both you and your customer feel safe. Any business using e-commerce or an integrated payment system should follow these guidelines:
PCI Compliance Do’s
- Regularly monitor and test networks/systems that have payment card data.
- Implement and enforce a company Information Security Policy.
- Install and keep up-to-date, a firewall that protects cardholder data stored within company systems.
- Every employee with computer access should be assigned a unique ID and use a robust password (e.g., mix of letters, numbers, and symbols), which is changed frequently (every 45-60 days).
- Restrict physical access to company systems and records with cardholder data to only those employees with a business “need-to-know.”
- Encrypt cardholder data if transmitting it over wireless or open, public networks.
- Use and regularly update anti-virus software.
- Have secure company systems and applications (e.g., good and frequent process to update all computers with necessary patches, process for identifying system/application vulnerabilities, etc.).
- Ensure any e-commerce payment solutions are tested to prevent programming vulnerabilities like SQL injection.
- Use a Payment Application Data Security Standard (PA-DSS) compliant payment application listed on the PCI Security Standards Council website.
PCI Compliance Don’ts
- Don’t store magnetic stripe cardholder data or the CVV2 code (the three digit value on the back of Visa cards) after authorization.
- Don’t use vendor-supplied or default system passwords or common/weak passwords.
- Don’t store cardholder data in any systems in clear text.
- Don’t leave remote access applications in an “always on” mode.
Get Started

