Pop Quiz: PCI Compliance
This post was first published on the Idealware Blog in August of 2009.
The credit card industry is doing the right thing by consumers and enforcing proper security measures regarding the handling of credit card information. You might have heard about this – a number of the popular vendors of donor databases are recommending upgrades based on their compliance with these regulations. The “Payment Card Industry Data Security Standard”, commonly known as PCIDSS, is a set of guidelines for securely handling credit card information. The standard has been around for about four years, but early enforcement efforts focused on companies with a high volume of credit card transactions. Now that they’re all in compliance, they’ve set their sites on smaller businesses and nonprofits. So, what does this mean? Here’s the simplest F.A.Q. that you’re likely to find on the topic:
- Do you ever process online, phoned in, or mailed-in credit card donations in-house? e.g., do you maintain the credit card number, expiration date and name of a donor?
If no, you don’t have to worry about this.
- If yes, do you have more than 20,000 such transactions annually?
Well, if you do, congratulations! Most nonprofits don’t, so they qualify for level 4 of the PCI Compliance scale. That results in a Self Assessment Questionnaire (SAQ) Validation type of “4”. Higher validation types are subject to stricter security standards.
The Self-Assessment Questionnaire will ask you all sorts of technical questions about your network and security procedures. Do you have a firewall? Are all of your transactions encrypted? Do you use anti-virus software? Is credit card information properly restricted to authorized staff?
Depending on your network, you might already comply with a lot of the requirements. If you don’t, then it might require a significant investment to get there.
- What will happen if I ignore this?
This isn’t government regulation (although your state might have laws in place that do mandate some similar response). Participation is not mandatory. But, should your security be breached, two things will happen:
- The compliance requirements for your organization will be reassessed to level one or two, and they’ll be much more costly and complicated to meet. The credit card companies might decline to do business with you if you don’t comply. Can you afford to not take Visa?
- You will likely be indirectly fined for non-compliance. The credit card companies will hold your bank liable for losses due to credit card theft in situations where your security was substandard. Your bank will likely pass that fine on to you.
- So what’s the easiest way to deal with this?
Simple: don’t handle credit cards. There are a number of services that, for a price, will do this for you, from Paypal and Google Checkout to CharityWeb and Blackbaud’s BBNow. Outsourced ECRM software (NetCommunity, Convio, Democracy in Action, etc.) will also handle it. The cost is likely not as significant as that of maintaining compliance or suffering the consequences of a non-compliant breach.
I’ll share that, at the Goodwill where I used to work, outsourcing wasn’t an option, because we were both a charity and a retailer. Our frustration was not that we didn’t have good security in place. It was that there were differences in how we had set up our security and the PCIDSS requirements. So, while we had done a lot of work and made significant investments, we still had to reconfigure things and spend more in order to be compliant. In addition to making our internal IT changes, we had to switch software programs in order to avoid storing credit cards unencrypted in our database, a typical problem. We also engaged a consultant. Once you are reasonably sure that you comply, then you must pay a security service to verify your efforts, another non-trivial expense.
Blackbaud has put together some good further reading on this topic (and they are one of the vendor’s whose latest software is compliant; ask your eCRM vendor!).