Visa Sets Own PCI Standard - Twenty-Four Seven Security

« Identity Management in Big Business | Main | 5 Hard Security Lessons Learned »

October 30, 2007
Visa Sets Own PCI Standard

With another PCI standard having come and gone this past Sep. 30th, and my blog at the time read, Many Companies Will Fail PCI Deadline, and with most of the headlines reading, it was high time someone stepped up to do something to secure credit card data.

Visa has done exactly that, calling it Payment Application Best Practices (PABP). All companies who collect credit card data will have to adhere to the following, with the final deadline July 1, 2010. And while Visa really cannot force software payment vendors to do anything, Visa customers will be prohibited from buying the software unless it meets the following requirements on said date:

Jan 1. 2008: Any new merchants that want to be authorized for payment card transactions will have to be using only PABP-validated applications. After this date, VisaNet processors and agents cannot certify new payment applications to their platforms if they are known to vulnerable.
July 1, 2008: VisaNet processors and agents must only certify new payment applications to their platforms that are PABP-compliant.
Oct. 1, 2008: Level 3 and 4 merchants that have just been authorized to accept card transactions must be PCI DSS compliant or use PABP-compliant applications. Level 3 merchants process between 20,000 and 1 million e-commerce transactions a year through Visa. Level 4 merchants have fewer than 20,000 e-commerce transactions per year -- and all other merchants, regardless of acceptance channel, which process fewer than 1 million Visa transactions annually. Acceptance channels refers to how transactions are conducted, online, in person or by phone, for instance.
Oct. 1, 2009: VisaNet processors and agents are required to decertify all vulnerable payment applications, meaning that companies still using them will no longer be PCI compliant.
July 1, 2010: After this date, all merchants, VisaNet processors and agents are require to use only PABP-compliant payment applications.

For more information directly from Visa, click here.