How does PCI DSS work?
The standard sets technical and operational requirements for protecting payment account data: network security, secure configuration, protection of stored card data, encryption in transit, vulnerability management, access control, monitoring and testing, and security policies. It applies to merchants, processors, acquirers, issuers and service providers. Whether an organisation must validate compliance, and how, is decided by the card brands and acquirers: large processors and service providers are assessed by qualified assessors, while most merchants complete a self-assessment questionnaire chosen by how they handle card data.
Why does it matter?
It decides how much of a merchant’s estate has to be secured and audited. As an illustrative example: a store that posts card numbers to its own servers needs the full questionnaire, quarterly scans and controls on every connected system. The same store using a hosted checkout, where card data never reaches its servers, can usually qualify for SAQ A and keeps its compliance work focused on the pages that load the checkout.
What does it require in practice?
Never storing sensitive authentication data after authorization, including the card security code, which the Council says cannot be kept even encrypted. Rendering stored card numbers unreadable. Restricting and logging access. And, since version 4.0, managing the scripts on payment pages, because attacks that inject code into checkouts are a common way card data is stolen.
Where does Omno use it?
Omno is a PCI DSS compliant payment orchestration platform. Card data entered in the hosted checkout, or in Card Fields on the merchant’s own checkout, goes to Omno’s compliant environment and is stored as tokens, so merchant systems receive tokens and transaction details. This can significantly reduce the part of their estate in PCI DSS scope; the merchant’s assessor decides the final scope. Merchants that need Omno’s attestation of compliance for their own assessment can ask Omno for it.