The document provides an overview of the Payment Card Industry Data Security Standard (PCI DSS v3), which outlines requirements for companies that handle credit card information to maintain secure environments. It discusses the importance of PCI DSS in the context of increasing card transactions, differentiates it from ISO 27001, and addresses common myths surrounding compliance. Additionally, it highlights the roles of various entities involved in PCI DSS and offers useful resources for further information.

1. PCI- DSS v3: Protecting
Cardholder Data

2. Agenda
• PCI DSS v3 : An Overview
• PCI DSS: How it is different from other similar
standards?
• PCI DSS vs ISO 27001
• Protecting Cardholder data through PCI DSS v3
• Common Myths regarding PCI DSS
• Security vs Compliance

3. PCI DSS: An Overview
1. The Payment Card Industry Data Security Standard (PCI DSS) is a set of requirements
designed to ensure that ALL companies that either:
• Process,
• Store or
• Transmit
“credit card information maintain a secure environment”.
2. The PCI DSS is administered and managed by the PCI SSC - Payment Card Industry
Security Standard Council (www.pcisecuritystandards.org), an independent body that
was created by the major payment card brands
(Visa, MasterCard, American Express, Discover and JCB.).

4. PCI DSS: Why it has become important?
• No of Card Transactions : 10000 per second
• No of non cash payments (as per 2013) = 333 Bn
(Card Payments = 181 billion
• If 7 billion on planet have a card, they would have
used at least 19 times.

5. PCI DSS: Card Details
Payment Account Number
(PAN)
Hologram
Cardholder name
Expiry Date
Payment Brand Logo
EMV CHIP

6. PCI DSS: 3 year Update cycle

7. PCI DSS: Who all entities are at play?
Payment Brands
Banks
Merchants
Service Providers

8. PCI DSS: What are Card present Transaction?

9. PCI DSS: What are Card not present
Transaction?

10. PCI DSS: What Card details can / can’t be
stored

11. PCI DSS: What Card details can / can’t be
stored

12. PCI DSS: Path to Certification

13. PCI DSS vs ISO27001
Just for clarity 

14. Compliance
Mandates
Compliance
Mandatory
Compliance Voluntary
Company Scope Functioning Levels Overall Company
Degree of
Compliance
Must Meet All
Standards
Standards Voluntary
Separation of
Systems
High Low
Degree of
Flexibility
Low High
FEATURES PCI - DSS ISO 27001:2013
PCI DSS vs ISO27001

15. Is it good idea to have both?
• ISO is an overall measure for companies to use for compliance
of information security management.
• PCI is a more standardized and regulated sub-section of
information security management that pertains specifically to
cardholder data.
• PCI compliance could be a part of overall ISO compliance if a
company were concerned with meeting both regulations.

16. Common Myths regarding PCI DSS
• One vendor and product will make us compliant
• Outsourcing card processing makes us compliant
• PCI DSS compliance is an IT project
• PCI DSS will make us secure
• PCI DSS is unreasonable; it requires too much
• PCI DSS requires us to hire a Qualified Security Assessor
• We don’t take enough credit cards to be compliant
• We completed a SAQ so we’re compliant
• PCI DSS makes us store cardholder data
• PCI DSS is too hard

17. Useful Links for PCI DSS
• https://www.pcisecuritystandards.org/security_standards/documents.php
• http://www.beyondsecurity.com/pci_compliance.html
• https://www.pcicomplianceguide.org/pci-faqs-2/

18. The way to see it……..
You can read as costs saved in fines, legal fees, decreases in stock equity, and especially
lost business

19. THANK YOU !!
- Manasdeep