--- title: The ABC's of PCI Compliance description: "By Josh Ewin and Andy Mahler The face of ecommerce is about to change in a big way. In the coming\n..." image: https://www.websitemagazine.com/hubfs/Imported_Blog_Media/gradient-regular-logo-mark-Jan-23-2023-12-23-26-6628-AM-Apr-10-2023-01-21-56-1775-PM-3-2.png --- [Log In](https://www.websitemagazine.com/_hcms/mem/login) [Subscribe](https://websitemagazine.tradepub.com/free/w_webk05/prgm.cgi) [![Website Magazine Logo](https://www.websitemagazine.com/hs-fs/hubfs/gradient-regular@3x-1.png?width=586&height=145&name=gradient-regular@3x-1.png "Website Magazine Logo")](http://Website%20Services,%20Inc.) - [About](https://www.websitemagazine.com/about) - [FAQs](https://www.websitemagazine.com/about/faq) - [Advertise](https://www.websitemagazine.com/about/advertise) - [Editorial Staff](https://www.websitemagazine.com/about/editorial-publishing-staff) - [Resources](https://websitemagazine.tradepub.com) - [Newsletter](https://www.websitemagazine.com/newsletter-sign-up) - More - [Contact Us](https://www.websitemagazine.com/contact) [Log In](https://www.websitemagazine.com/_hcms/mem/login) [Subscribe](https://websitemagazine.tradepub.com/free/w_webk05/prgm.cgi) Search - [Latest](https://www.websitemagazine.com) - [Design](https://www.websitemagazine.com/web-design) - [Development](https://www.websitemagazine.com/web-development) - [SEO](https://www.websitemagazine.com/seo) - [Ecommerce](https://www.websitemagazine.com/ecommerce) - [Content](https://www.websitemagazine.com/content) - [Marketing](https://www.websitemagazine.com/marketing) - [Advertising](https://www.websitemagazine.com/advertising) - [Email](https://www.websitemagazine.com/email) - [Infographics](https://www.websitemagazine.com/infographics) - [View All Topics](https://www.websitemagazine.com/channels) # The ABC's of PCI Compliance ![Peter Devereaux](https://www.websitemagazine.com/hubfs/Peter_Devereaux.png) [by Peter Devereaux](https://www.websitemagazine.com/marketing/author/peter-devereaux) 30 Oct, 2008 - - - [mailto:?Body=https://www.websitemagazine.com/marketing/the-abcs-of-pci-compliance](mailto:?Body=https://www.websitemagazine.com/marketing/the-abcs-of-pci-compliance) - Link Copied! ![The ABC's of PCI Compliance](https://www.websitemagazine.com/hubfs/Imported_Blog_Media/gradient-regular-logo-mark-Jan-23-2023-12-23-26-6628-AM-Apr-10-2023-01-21-56-1775-PM-3-2.png) ***By Josh Ewin and Andy Mahler***   The face of ecommerce is about to change in a big way. In the coming months, the Payment Card Industry (PCI) implements DSS - the new standard in security practices for ecommerce companies. Whether you are an online merchant, webmaster or Web host, it is vital to understand the fundamental requirements of the PCI DSS (Payment Card Industry Data Security Standard) to keep your business and your clients from incurring stiff penalties.   **The Payment Card Industry Data Security Standard** PCI DSS was developed by the founding brands of the PCI Security Standards Council, including American Express, JCB, Discover, MasterCard and  Visa. The PCI Council has established this standard to protect cardholder information. As a vendor, it is critical that you are not only  aware of the new requirements, but also understand the tools and practices available to remain in compliance with the new standard. **The Need to Comply** PCI DSS provides a comprehensive set of requirements for security management, policies, procedures, network architecture, software design and other critical protective measures. The standards outlined within PCI DSS can be used to help build the security policies and structure for the enterprise, data centers and your customers. This set of standards should be used as a best practices guide to implement and follow. Even though the PCI Council manages the underlying security standards, compliance is set independently by the individual brands. Each brand  has its own set of penalties that can range from $8 per compromised account to more than $158,000 per incident, with additional penalties ranging from restrictions to outright loss of use. **PCI DSS Requirements** There are twelve major requirements to the PCI standard: *Build and Maintain a Secure Network* 1. Install and maintain a firewall configuration to protect cardholder data. 2. Do not use vendor-supplied defaults for system passwords and other security parameters. *Protect Cardholder Data* 3. Protect stored cardholder data. 4. Encrypt transmission of cardholder data across open, public networks. *Maintain a Vulnerability Management Program* 5. Use and regularly update anti-virus software. 6. Develop and maintain secure systems and applications. *Implement Strong Access Control Measures* 7. Restrict access to cardholder data by business need-to-know. 8. Assign a unique ID to each person with computer access. 9. Restrict physical access to cardholder data. *Regularly Monitor and Test Networks* 10.Track and monitor all access to network resources and cardholder data. 11. Regularly test security systems and processes. *Maintain an Information Security Policy* 12. Maintain a policy that addresses information security. In June 2008, The PCI Council added Appendix A, which is "PCI DSS Applicability for Hosting Providers." In a nutshell, all service providers with access to cardholder data (including hosting providers) must adhere to the PCI DSS. In addition, Requirement 2.4 states that hosting providers must protect each entity's hosted environment and data. Therefore, hosting providers must give special consideration to the following:   - A.1 - Protect each entity's (that is merchant, service provider, or other entity) hosted environment and data, as in A.1.1 through A.1.4: - A.1.1 - Ensure that each entity only has access to its own cardholder data environment. - A.1.2 - Restrict each entity's access and privileges to own cardholder data environment only. - A.1.3 - Ensure logging and audit trails are enabled and unique to each entity's cardholder data environment and consistent with PCI DSS Requirement 10. - A.1.4 - Enable processes to provide for timely forensic investigation in the event of a compromise to any hosted merchant or service provider. A hosting provider must fulfill these requirements as well as all other relevant sections of the PCI DSS. Note: Even though a hosting provider may meet these requirements, the compliance of the entity that uses the hosting provider is not necessarily guaranteed. Each entity must comply with the PCI DSS and validate compliance as applicable. Besides being good security practice, if followed, a Web hosting company providing procedures, processes and tools to meet the requirements can be a competitive advantage. Specifically, it can be used to differentiate your services from your competitors and entice ecommerce companies to host their sites with you. **Application Security** New for the latest release of PCI DSS is requirement 6.6. It requires that all Web-facing applications be protected against known attacks. Hosting companies over the years have become very good at protecting the network and the operating systems from attacks, while the applications have been left vulnerable. Hackers are now attacking using SQL Injection and Path Traversal techniques to gain access to applications and valuable information. Application security is an area that hosting companies have little or no control over. Once these hacks occur, and they do, expenses and man-hours mount as Web hosts deal with customer complaints. To combat these attacks the PCI DSS recommends installing an application layer firewall in front of Web-facing applications known as a Web Application Firewall (WAF). One example of a WAF is Applicure's dotDefender, which works well for hosting companies, as it supports dedicated, shared and virtual environments running either Windows IIS or Apache on Linux platforms. Offering a WAF to clients will provide the security they need for PCI compliance, additional revenue for Web hosts, and reduce customer care calls addressing hacking attacks. The penalties for not following the PCI's DSS are significant and should not be ignored by any company accepting credit cards online or any company providing supporting services, like Web hosting companies. That being said, gaining compliance is relatively easy and could prove to be a competitive advantage if used creatively.   *Josh Ewin ([jewin@fortressitx.com](https://mce_host/content/controlpanel/blogs/posteditor.aspx/mailto:jewin@fortressitx.com)">jewin@fortressitx.com) is VP of Sales and Marketing for [DedicatedNow](https://www.dedicatednow.com/). Andy Mahler ([andy.mahler@applicure.com](https://mce_host/content/controlpanel/blogs/posteditor.aspx/mailto:andy.mahler@applicure.com)">andy.mahler@applicure.com) is Director, Business Development for [Applicure Technologies](https://www.applicure.com/).*   ![Peter Devereaux](https://www.websitemagazine.com/hubfs/Peter_Devereaux.png) [Peter Devereaux](https://www.websitemagazine.com/marketing/author/peter-devereaux) As the Editor-in-Chief of Website Magazine and President of Website Services, Peter has established himself as a prominent figure in the digital marketing industry. With a wealth of experience and knowledge, Peter has been a driving force in shaping the landscape of digital marketing. His leadership in creating innovative and targeted marketing campaigns has helped numerous businesses achieve their revenue growth goals. Under his direction, Website Magazine has become a trusted source of information and insights for digital marketers worldwide. As President of Website Services, Peter oversees a team of talented professionals who specialize in SEO/SEM, email marketing, social media, and digital advertising. Through his hands-on approach, he ensures that his team delivers exceptional results to their clients. With a passion for digital marketing, Peter is committed to staying up-to-date with the latest industry trends and technologies, making him a sought-after thought leader in the field. - - - - - [mailto:peter.devereaux@websitemagazine.com](mailto:peter.devereaux@websitemagazine.com) #### Popular Post ### [31 Back-to-School Keyword Targets ![31 Back-to-School Keyword Targets](https://www.websitemagazine.com/hubfs/Imported_Blog_Media/schoolbus-1-1-1-1.jpg)](https://www.websitemagazine.com/marketing/31-back-to-school-keyword-targets) ### [GoDaddy Goes .XXX ![GoDaddy Goes .XXX](https://www.websitemagazine.com/hubfs/Imported_Blog_Media/gradient-regular-logo-mark-Jan-23-2023-12-15-39-1451-AM-Apr-10-2023-01-36-09-0977-PM-3-1.png)](https://www.websitemagazine.com/marketing/godaddy-goes-xxx) ### [23 Cool Tech Facts ![23 Cool Tech Facts](https://www.websitemagazine.com/hubfs/Imported_Blog_Media/fact_100x100-2-1-1-1.png)](https://www.websitemagazine.com/marketing/23-cool-tech-facts) #### Subscribe to Our Newsletter! [![](https://a.impactradius-go.com/display-ad/13053-1438301)](https://semrush.sjv.io/c/3976891/1438301/13053)![](https://imp.pxf.io/i/3976891/1438301/13053) #### Latest in Marketing [![3 Tips to Make Your Website More User-Friendly in 2023](https://www.websitemagazine.com/hubfs/Imported_Blog_Media/pexels-photo-2284350-1-1.jpg) 3 Tips to Make Your Website More User-Friendly in 2023](https://www.websitemagazine.com/marketing/3-tips-to-make-your-website-more-user-friendly) [![Web.com Launches New Professional QuickStart Website Service](https://www.websitemagazine.com/hubfs/Imported_Blog_Media/pexels-photo-4348404-1.jpg) Web.com Launches New Professional QuickStart Website Service](https://www.websitemagazine.com/marketing/web-com-launches-new-professional-quickstart-website-service) [![6 Ways to Stretch Your Marketing Budget](https://www.websitemagazine.com/hubfs/Imported_Blog_Media/gradient-regular-logo-mark-Feb-07-2023-03-32-33-0828-PM-Apr-25-2023-03-10-37-2214-AM-1.png) 6 Ways to Stretch Your Marketing Budget](https://www.websitemagazine.com/marketing/6-ways-to-stretch-your-marketing-budget) [![5 Reasons Visitors Leave Your Website and Website Tracking Tools to Track Website Visitors](https://www.websitemagazine.com/hubfs/pexels-photo-1008155.jpg) 5 Reasons Visitors Leave Your Website and Website Tracking Tools to Track Website Visitors](https://www.websitemagazine.com/marketing/5-reasons-visitors-leave-your-website) [![5 Lessons About Workplace Energy](https://www.websitemagazine.com/hubfs/Imported_Blog_Media/distress-1-1-1-1.png) 5 Lessons About Workplace Energy](https://www.websitemagazine.com/marketing/5-lessons-about-workplace-energy) [![Y Combinator Startups to #WebTechWatch](https://www.websitemagazine.com/hubfs/Imported_Blog_Media/startup-funding-4-1-1-1.jpg) Y Combinator Startups to #WebTechWatch](https://www.websitemagazine.com/marketing/y-combinator-startups-to-webtechwatch) [![gradient-regular@3x](https://www.websitemagazine.com/hs-fs/hubfs/gradient-regular@3x.png?width=128&height=128&name=gradient-regular@3x.png)](https://www.websitemagazine.com/) 999 E Touhy Ave, Des Plaines, IL 60018   [info@websitemagazine.com](mailto:info@websitemagazine.com) [(888) 7WEBMAG](tel:18887932624) [(312) 313-6576](tel:13123136576) About - [Advertise](https://www.websitemagazine.com/about/advertise) - [Editorial](https://www.websitemagazine.com/about/editorial-publishing-staff) - [Contact Us](https://www.websitemagazine.com/contact) Resources Membership - Login - Subscribe Signup for our newsletter © 2026 Website Magazine. All Rights Reserved - [Privacy Policy](https://www.websitemagazine.com/about/privacy) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Peter Devereaux", "url" : "https://www.websitemagazine.com/marketing/author/peter-devereaux" }, "dateModified" : "2023-05-01T21:26:23.544Z", "datePublished" : "2008-10-30T05:00:00.000Z", "headline" : "The ABC's of PCI Compliance", "image" : [ "https://www.websitemagazine.com/hubfs/Imported_Blog_Media/gradient-regular-logo-mark-Jan-23-2023-12-23-26-6628-AM-Apr-10-2023-01-21-56-1775-PM-3-2.png" ], "mainEntityOfPage" : { "@id" : "https://www.websitemagazine.com/marketing/the-abcs-of-pci-compliance", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.websitemagazine.com/hubfs/gradient-regular@3x-1.png" }, "name" : "Website Services, Inc." } } ``` ```json { "@context" : "https://schema.org", "@type" : "NewsArticle", "author" : [ { "@type" : "Person", "name" : "Peter Devereaux" } ], "headline" : "The ABC's of PCI Compliance", "publisher" : { "name" : "Website Magazine", "url" : "https://www.websitemagazine.com/" } } ```