How MFT Helps with PCI Compliance

Share:

Debit and credit card information is at a higher risk than ever. From 2019 to 2020, identity theft by credit card fraud increased by 44.6%.

Unfortunately, many companies aren’t securing this information as well as they should. Only 27.9% of companies were compliant with the Payment Card Industry Data Security Standard (PCI DSS) in 2020.

What Is PCI DSS?

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards that protects debit and credit cardholders from fraud.

PCI DSS was created in 2004 by the Payment Card Industry (PCI) Security Standards Council (SSC). The PCI SSC founding members were American Express, Discover Financial Services, JCB International, Mastercard and Visa.

PCI DSS protects cardholders’ account numbers, names, expiration dates and card verification values (CVV).

cardholders information that pci protects

Who Has to Be PCI Compliant?

PCI DSS applies to all merchants who accept credit cards and other payment processing organizations. Because PCI DSS isn’t a law, your business might not need to be compliant.

Your company needs to be PCI DSS compliant if:

  1. Your company signed a contract with a credit card company as a merchant, or
  2. Your state added some of PCI DSS to its laws

MFT Features that Help with PCI Compliance

There are 6 goals and 12 requirements of PCI DSS:

Goals Requirements
Build and maintain a secure network 1. Install and maintain a firewall configuration to protect cardholder data
2. Do not use vendor-supplied defaults for system passwords and other security parameters
Protect cardholder data 3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across open, public networks
Maintain a vulnerability management program 5. Use and regularly update antivirus software or programs
6. Develop and maintain secure systems and applications
Implement strong access control measures 7. Restrict access to cardholder data by business need-to-know
8. Assign a unique ID to each person with computer access
9. Restrict physical access to cardholder data
Regularly monitor and test networks 10. Track and monitor all access to network resources and cardholder data
11. Regularly test security systems and processes
Maintain an information security policy 12. Maintain a policy that addresses information security for employees and contractors

Managed file transfer (MFT) solutions secure file transfers to help companies achieve compliance.

Here are the PCI DSS goals matched with MFT features that support them:

  1. Build and maintain a secure network.
  2. MFT solutions should use firewalls and require IP address whitelisting to protect against brute force attacks.

  3. Protect cardholder data.
  4. By encrypting files in transit and at rest, MFT solutions keep cardholder information safe. They also should have retention policies to archive or purge files after a certain time period.

  5. Maintain a vulnerability management program.
  6. MFT solutions should scan every file for viruses and have multiple application security measures in place to keep unauthorized users out.

  7. Implement strong access control measures.
  8. MFT solutions should have strong user authentication, including support for two-factor authentication. They should also require endpoint authentication with a password or key.

    Role-based access controls in MFT solutions help administrators limit access according to the security principle of least privilege.

  9. Regularly monitor and test networks.
  10. MFT solutions should track all file transfers and user actions. They should support email and text alerts in case a file transfer fails or no files are received.

  11. Maintain a policy that addresses information security for employees and contractors.
  12. Companies can require employees to use an MFT solution in their information security policies to protect confidential employee and customer data.

Move Closer to Full Compliance

The risk of data theft and fraud has been increasing – how do you protect your customers?

We can help. Thru, our cloud managed file transfer (MFT) solution, has many features that help your company achieve compliance, including:

  • Encryption in transit and at rest
  • PGP encryption
  • Role-based access controls
  • Multi-level retention policies

For more information, please contact our sales team.

 

1 https://mint.intuit.com/blog/planning/credit-card-fraud-statistics/
2 https://www.verizon.com/business/resources/reports/payment-security-report/
3 https://www.pcisecuritystandards.org/
 

Share:

Have questions about managed file transfer?

Get answers, not a sales pitch. Our experts have analyzed, discussed and solved difficult file transfer challenges since 2002. We are here to help you.

Scroll to Top