What Is PCI Compliance On Magento And Why To Take It Seriously?

A 2021 report by IBM found that the average cost of a data breach touched $4.24 million in 2020, the highest it’s ever been in the past 17 years. With data breaches on the rise globally, it’s no longer optional to protect your business and its customers from online threats.

Fortunately, if you own a Magento store, you’re already a step ahead of the competition. Adobe employs several features to ensure the security of its platform, such as:

• Two-factor authentication,
• Session validation,
• A free security scan tool,
• Strict default content security policies,
• Complementary PCI compliance for Magento for Adobe Commerce Cloud users.

But if you’re a Magento 2 Open Source or an Adobe Commerce on-premise user, you need to ensure the PCI compliance of your Magento store yourself. Here’s everything you should know about PCI compliance on Magento 2.

I. An Overview Of PCI Compliance

The Payment Card Industry Data Security Standards (PCI DSS) are a set of requirements for businesses that process, store, and transmit card data online, established on December 15th, 2004.

Before PCI DSS, major card companies operated their own programs to ensure safe online transactions. However, this presented a challenge for merchants as there were several interoperability issues between their programs. To eliminate those issues and establish a consistent standard worldwide, global payments industry stakeholders came together to establish the PCI DSS.

As new technologies and threats emerged, they identified a need for revisions and clarifications to the existing standard. Therefore, Discover Financial Services, JCB International, Visa, MasterCard, and American Express came together to establish the PCI Security Standards Council (PCI SSC) as a governing entity to develop and mandate PCI standards globally.

The first amendment to the PCI DSS, version 1.1, came after establishing the PCI SSC in September 2006. Since then, the PCI SSC has updated and released several revisions to the original version to adapt to the evolving eCommerce industry.

The latest version, 3.2.1, released in May 2018, outlines twelve requirements focusing on six objectives. Together, they address a range of operational and technical components relating to cardholder data. You can access the latest standard and its earlier versions from the PCI document library.

And if you prefer a concise version of the current standards, here’s a brief overview:

II. PCI Compliance Levels

PCI standards apply to all companies processing online payments. However, the degree of compliance required from each company is categorized into four levels based on the volume of transactions processed annually.

Here’s an overview of the four levels of PCI compliance and what they mean for eligible businesses:

Level 1

Level 1 PCI compliance is the highest level that applies to merchants processing more than six million online card transactions each year. They’re required to carry out an internal audit once a year and undergo a quarterly PCI scan by an Approved Scanning Vendor (ASV.)

Level 2

Level 2 PCI compliance applies to businesses processing between one and six million online card transactions each year. They’re required to complete an annual assessment with a Self-Assessment Questionnaire (SAQ) and, in some cases, a quarterly PCI scan as well.

Level 3

Level 3 PCI compliance applies to businesses processing between 20,000 and one million online card transactions each year. They’re required to complete an annual SAQ and a quarterly PCI scan if needed.

Level 4

Level 4 PCI compliance applies to businesses processing less than 20,000 online card transactions each year. They’re required to complete the annual SAQ and, if required, carry out a quarterly PCI scan as well.

III. PCI Compliance On Magento Explained

As you’ve gathered by now, PCI compliance is mandatory for all online businesses that process card payments. Failure to comply with the outlined standards can result in massive fines and being barred from processing online payments indefinitely.

Adobe simplifies PCI compliance on Magento for its users in several ways. They’re certified as a PCI Level 1 Solution Provider. This certification ensures that every business, no matter the size of its operation, can rely on ACC to handle its PCI compliance.

Merchants using ACC can even use Adobe’s PCI Attestation of Compliance for their businesses. This simplifies achieving and maintaining PCI compliance for ACC users that process millions of online card transactions each year.

Further, they’ve integrated several payment gateways into Magento. This allows merchants to securely process and transmit card data using Direct Post API methods and hosted payment forms integrated into the checkout pages.

The Direct Post API method sends information directly to the payment gateway. This method prevents any confidential information from reaching the Magento application server. Similarly, third-party hosted payment forms allow payment gateways to secure any sensitive data and limit the liability for Magento users.

Adobe’s approach to PCI compliance on Magento ensures that merchants can use Magento and update the core platform without worrying about compliance reassessment. This simplifies compliance requirements and allows users to validate compliance using lower-level SAQs like A or A-EP instead of D.

Although Adobe simplifies PCI compliance on Magento requirements, they do not eliminate them. Ensuring PCI compliance can be challenging, especially for Magento 2 Open Source users. However, there are some steps you can take to work towards ensuring PCI compliance.

If you’re using a payment gateway, opt for well-known third-party providers like Stripe and PayPal and allow customers to complete their transactions on your payment processors’ website instead of your own. 

IV. Six Reasons Why You Should Take PCI Compliance On Magento Seriously

Meeting PCI compliance is compulsory. However, merchants often view it as an “IT problem.” They fail to realize that the consequences of being PCI DSS non-compliant can cripple their business.

Here are six reasons why we strongly recommend taking PCI compliance for your online store seriously.

4.1. Lays A Strong Foundation

Ensuring PCI DSS compliance requires a multi-layered approach to online security consisting of firewalls, Magento code audits, and following security best practices. The twelve PCI requirements outlined by the PCI SSC help you lay down comprehensive measures and re-examine existing security procedures.

Additionally, they help you comply with global security standards followed by leading organizations. This builds a robust foundation that ensures the security of your online store and helps your organization prepare for other compliance standards such as the SOC and ISO 27001 standards.

4.2. Builds Trust

The recent increase in data breaches globally has made the average consumer conscious of their data and online presence. A 2019 study by Cisco Systems found that 84% of consumers surveyed cared about data privacy, and 80% considered it a buying factor.

Even though your customers may not understand the nuances of PCI compliance, the presence of a PCI compliance logo on your store can act as a trust signal. It can help reassure them that their data is in safe hands.

4.3. Protects Your Store Data

PCI compliance ensures your store data, including customer and employee information, is safe. You can avoid security breaches like malware, card skimming, and remote-access attacks by implementing security measures as part of the compliance requirements.

Quarterly assessments and annual audits can help you follow the latest security best practices and cover all your bases. With fewer chances of a security incident, it’ll keep your store data away from prying eyes.

4.4. Helps You Avoid Lawsuits

A hacked Magento store is every merchant’s nightmare. Not only does it leave you at risk of losing business, but it also introduces the possibility of legal complications arising from lawsuits by customers and other organizations.

In 2015, the Federal Trade Commission sued Wyndham Hotels & Resorts for placing their customers’ payment card information at risk due to inadequate security measures. Thus, a security incident can leave your business exposed to lawsuits and hurt your reputation tremendously.

4.5. Minimizes The Total Costs Of A Security Incident

Besides being sued, a security incident can also result in a barrage of fines and penalties that can cripple your business. Here’s a list of some of the costs incurred by a business after a security breach:

• Forensic investigation: $10,000 to $100,000
• Legal consultation: $10,000 and above.
• Breach notification costs: $1,000 and above.
• Merchant processor fines: $5,000 to $50,000
• Card brand fines: $5,000 to $500,000

The above costs only represent a small portion of the expenses incurred by a business after a security incident. Dealing with litigation and achieving successful outcomes can drive these costs up significantly.

4.6. Gives You Peace Of Mind

PCI DSS compliance helps protect your online store from known threats and vulnerabilities. It gives you the assurance that you’re maintaining security standards in line with global requirements and reduces the likelihood of a security breach.

With a PCI-compliant store, you won’t need to worry about risking the loss of your brand or business reputation. Instead, you’ll have more time on your hands to focus on growing your business.

V. PCI Compliance On Magento Mitigates Risk

Security breaches can arise from various sources, online and offline. But ensuring PCI compliance minimizes the risk considerably.

Meeting PCI compliance on Magento is more than using an SSL certificate and a firewall. It involves a comprehensive assessment of your online infrastructure to optimize it for compliance with global standards.

It’s important to remember that PCI compliance on Magento is an ongoing task. As newer and more advanced threats emerge, the PCI SCC will upgrade its standards to tackle them. Therefore, you must ensure you review compliance requirements each quarter and conduct thorough audits annually.

VI. Author Bio

Val Kelmuts is the Chief Executive Officer and Co-founder at Staylime, a Magento design, and development company headquartered in Redwood City, California. He’s passionate about eCommerce and Magento in particular. Val believes that personal relationships and dedication to work drive the success of joint endeavors.

Thank you and stay safe!