{"id":1568,"date":"2019-07-24T18:08:32","date_gmt":"2019-07-24T18:08:32","guid":{"rendered":"https:\/\/www.thesslstore.com\/resources\/?p=1568"},"modified":"2019-08-23T15:10:42","modified_gmt":"2019-08-23T15:10:42","slug":"what-are-the-pci-dss-merchant-compliance-levels","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/resources\/what-are-the-pci-dss-merchant-compliance-levels\/","title":{"rendered":"What Are The PCI DSS Merchant Compliance Levels?"},"content":{"rendered":"\n

PCI DSS, more formally known as the Payment Card Industry Data Security Standards<\/a>, serves as the compliance framework that regulates companies accepting payment cards. It\u2019s a common-sense regulation that basically mandates businesses follow certain security best practices in order to safeguard the sensitive information they collect. It’s what governs all organizations that take payment cards, but there\u2019s more to it than just whether or not you\u2019re compliant. PCO DSS also has levels that determine how merchants are categorized depending on the number of transactions that they handle annually.<\/p>\n\n\n\n

One of the questions we get asked all the time is what the various PCI levels are and which one you may fall under. It\u2019s a point of consternation that doesn\u2019t need to be. That\u2019s actually pretty standard when it comes to compliance issues; companies often look at the stakes and figure the requirements must be difficult to comply with \u2014 but they\u2019re actually not that complicated when it comes to PCI DSS. It\u2019s all very straightforward. <\/p>\n\n\n\n

All PCI organizations are expected to uphold 12 basic requirements:<\/p>\n\n\n\n

  1. Install and maintain a firewall.<\/li>
  2. Change passwords and usernames from vendor defaults.<\/li>
  3. Protect stored cardholder data.<\/li>
  4. Encrypt transmission of cardholder data.<\/li>
  5. Use antivirus software and upgrade it regularly.<\/li>
  6. Developer and maintain secure systems\/applications.<\/li>
  7. Restrict access to data on a need-to-know basis.<\/li>
  8. Assign everyone with network access a unique ID.<\/li>
  9. Restrict physical access to data.<\/li>
  10. Track and monitor all access to network data.<\/li>
  11. Regularly scan security systems and processes.<\/li>
  12. Maintain a policy that addresses security.<\/li><\/ol>\n\n\n\n

    None of those is particularly challenging, with the scanning requirement being the only real point of confusion for many organizations. One thing that\u2019s less understood than the requirements, though, are the various PCI levels.<\/p>\n\n\n\n

    The 4 PCI DSS Security Compliance Levels<\/h3>\n\n\n\n

    There are four PCI compliance levels in total, and they dictate the amount of assessment and validation an organization will need to be considered compliant. They are broken down by the number of transactions processed per year and are supposed to give the payment card industry \u2014 namely the big credit card companies \u2014 an idea about risks associated with an entity. <\/p>\n\n\n\n

    Rather nonintuitively, the levels lessen as the numbers increase, with one being the most stringent and four being the least. We guess it\u2019s kind of like the U.S.\u2019s DEFCON (defense readiness condition) scale levels for nuclear war \u2014 DEFCON 5 being the least severe risk and DEFCON 1 being the most serious. <\/p>\n\n\n\n

    Level<\/strong><\/td>Description<\/strong><\/td><\/tr>
    Level 1 <\/td>> 6,000,000 transactions per year; OR any merchant that\u2019s had a data breach <\/td><\/tr>
    Level 2 <\/td>Between 6,000,000-1,000,000 online transactions per year <\/td><\/tr>
    Level 3 <\/td>Between 1,000,000-20,000 online transactions per year <\/td><\/tr>
    Level 4 <\/td>> 20,000 online transactions or 1,000,000 regular transactions per year <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    What Is Required For Each Of The PCI Compliance Levels?<\/h3>\n\n\n\n

    Here are the requirements for each level in terms of the\nvalidation that will be needed. <\/p>\n\n\n\n