PCI Compliance

Summary of Feedback Received for PCI DSS v2.0 and PA-DSS v2.0, August 2012 This document presents a summary of the feedback that was provided to the Payment Card Industry Security Standards Council (PCI SSC) relating to v2.0 of the PCI Data Security Standard (PCI DSS) and PCI Payment Application Data Security Standard (PA-DSS).

Data Encryption 101: A Pragmatic Approach to PCI Compliance Educational, unbiased white paper cuts through techno-babble and discusses how to select appropriate software for PCI encryption and key management. It provides you with the information you need to make an intelligent cryptographic choice.

Tokenization Guidance: How to reduce PCI compliance costs Informative white paper by Securosis explains how tokenization reduces the cost of PCI compliance by 50%, and provides guidance the PCI Council failed to provide in its guidelines for tokenization.

Tokenization at the POS The mapping of the token to a specific card number is maintained in what tokenization providers often refer to as a vault, a database maintained in their data center that is highly secure. Their operations are, of course, PCI compliant and include encryption. For more information about this particular slide, please visit Mercator Advisory Group's Fraud, Risk & Analytics Service here.

PCI Skimming Prevention Suggestions The PCI Council presents best practices for merchants regarding skimming protection. For more information about the Council's efforts, visit them here.

Getting Started with PCI Data security for merchants and payment card processors is the vital byproduct of applying the information security best practices found in the Payment Card Industry Data Security Standard (PCI DSS). The standard includes 12 requirements for any business that stores, processes or transmits payment cardholder data. For more information about the PCI Council's efforts, visit them here.

End-to-End Encryption Heartland Payment Systems is investing heavily in its end-to-end encryption (E3) initiative including the cost of trademarking E3 to represent its approach. Heartland views encryption as operating across 5 zones.