Learn How SVC Became PCI-Certified
At SVC, the security of sensitive customer data is a top priority, so we partnered with a US-based third-party computer security company to achieve our PCI DSS (Payment Card Industry Data Security Standard) certification. This independent audit confirmed that we meet the highest standards for securely handling credit card transactions on behalf of our clients. Here’s an overview of the process that led to our certification:
1. Understanding Our Operations
We began by collaborating with third-party auditors to map out how we process credit card transactions. This step involved identifying every point where sensitive cardholder data is handled, stored, or transmitted to ensure we understood the potential risks and areas needing protection.
2. Assessing Our Security Measures
The auditors then evaluated the security controls we have in place to protect cardholder data:
- Network Security: We secured our network with advanced firewalls and monitoring systems to protect against external threats.
- Access Controls: We implemented strict access policies, ensuring only authorised personnel can interact with sensitive information.
- Encryption: All cardholder data is encrypted in storage and during transmission, adding an extra layer of protection against unauthorised access.
3. Strengthening Our Policies and Procedures
To ensure ongoing compliance, we worked closely with the security company to develop comprehensive internal policies for handling credit card data. We established clear protocols for data management, employee training, and incident response to safeguard against potential breaches.
4. Implementing Physical Security
Physical security was also a key focus during the audit. Our offices and data handling areas are equipped with access controls and surveillance systems to prevent unauthorised entry, ensuring that cardholder data is protected both digitally and physically.
5. Testing Our Systems
As part of the audit, the third-party security company performed rigorous system testing, including vulnerability scans and penetration testing. These tests were designed to identify potential weaknesses and ensure our systems were fully capable of withstanding cyber threats.
6. Focusing on Employee Practices
Our staff, who handle cardholder data directly, underwent thorough training on best practices for data security. We established strict protocols to ensure that sensitive information is always processed safely and securely.
7. Ensuring Compliance Documentation
Throughout the process, we maintained detailed records of our security practices, system logs, and audit trails, all of which were reviewed by the auditors to ensure our continuous compliance with PCI DSS standards.
8. Independent Audit and Certification
Finally, after completing the comprehensive audit, the US-based third-party security firm verified that SVC fully met PCI DSS requirements. Their independent certification affirms that our security measures meet the industry’s most stringent standards for protecting credit card transactions.
By partnering with an independent third-party security company, we have ensured that SVC’s PCI certification is thorough and validated by industry experts. This gives our clients peace of mind that their data is handled securely and responsibly.
