The Best Way to Simplify PCI Compliance is to Handle Less Cardholder Data

Organisations preparing for PCI DSS compliance often start by asking how to secure their cardholder data environment. However, a more useful question may come first: Does the business need to handle card data at all? Reducing the amount of card data that enters an organisation's systems can significantly reduce the number of systems and processes in scope for PCI DSS.

PCI DSS applies to systems that store, process or transmit cardholder data. It also covers certain systems that connect to or can affect the security of those systems. This means every in-scope system must meet the relevant security requirements and remain properly maintained. When businesses remove card data from a system, they may also reduce the compliance work linked to that system.

Businesses Are Finding Ways to Reduce Card Data Exposure

One common approach is to outsource the payment page. A business can redirect customers to a validated payment provider or use hosted payment fields so that customers enter their card details directly into the provider's environment. This approach can reduce the amount of card data that reaches the merchant's own systems and may reduce its PCI DSS scope.

Tokenisation provides another option. Tokenisation replaces a card number with a token that has no inherent value if stolen. Systems that handle only the token avoid handling the original card data, although the exact PCI DSS scope depends on how the tokenisation solution works.

Businesses that accept payments in person can also consider point-to-point encryption. This approach encrypts card data at the point of use. When properly designed and implemented, the business systems do not receive the card data in a usable form.

Network segmentation can also help organisations reduce their PCI DSS scope. Businesses can separate the cardholder data environment from other parts of their network. This can keep systems outside the cardholder data environment out of scope. However, the organisation must properly design, maintain and test the segmentation. Simply claiming two networks are separate isn't enough.

Removing Unnecessary Card Data Can Reduce Compliance Work

Some businesses still store card data because outdated processes no longer require it. A company may have stored card details for recurring payments in the past but now use a payment provider for that service. Another business may keep old customer data for dispute handling even though a token could serve the same purpose.

Businesses should review why they store card data and whether they still need it. Removing unnecessary card data can reduce the number of systems that require additional security controls and monitoring.

Businesses Need to Map How Card Data Moves

Before investing in new security controls, organisations should first understand how card data moves through their systems. They should identify where card data enters the business, where it travels, where it is stored and who can access it. Businesses should then ask whether the data needs to be present at each stage.

This review can uncover card data flows that exist because of old processes. It can also reveal data that employees may not realise they are handling. A report, email, spreadsheet or other internal record can sometimes contain card information without a clear business need.

Call recordings require particular attention. Contact centres that record calls may capture card numbers when customers provide payment information over the phone. In such cases, the card data may exist in the recording system, storage environment, backups and even transcription services. Each location can create additional security and compliance concerns.

Scope Reduction Should Come Before Major PCI Spending

Businesses can spend significant time and money securing systems that may not need to handle card data in the first place. Organisations can avoid some of this work by reviewing their data flows before they begin implementing controls.

The first step should therefore be simple: find out where card data exists and ask whether it needs to be there. Businesses can then identify opportunities to remove unnecessary card data, use suitable payment technologies and separate sensitive systems from the rest of their environment.

For organisations preparing for PCI DSS compliance, an experienced ISO and information security consultancy can help review existing processes, identify security gaps and establish structured controls. The goal should not be to create more compliance work than necessary. The goal should be to build a secure environment with the right scope and the right controls.