Trustwave SpiderLabs Uncovers Unique Cybersecurity Risks in Today's Tech Landscape. Learn More

Trustwave SpiderLabs Uncovers Unique Cybersecurity Risks in Today's Tech Landscape. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Heads-Up Acquirers: You Have New PCI Security Rules to Follow for Your Small Merchants

When you think about all the customer data that the average retailer has to keep secure, it could feel overwhelming: Names, addresses, dates of birth, Social Security numbers, bank account numbers and, of course, credit card numbers.

Historically Payment Card Industry Data Security Standard (PCI DSS) has been focused on the large and big-box merchants, sometimes known as the "Level 1" businesses. But as their hands were forced to implement more mature security, the threats moved on as well.

Nowadays and perhaps contrary to conventional wisdom, it is actually the pizza restaurant down the street - not the massive department store chain - that is facing the most immediate data security threats. Small and midsize businesses, which typically fall into Level 4 of PCI DSS, are quite vulnerable to hackers and fraudsters, partly because their IT environments are easy to intrude upon. Add to this the fact that many of these merchants work with third-party service providers, which themselves are not practicing good security hygiene, and the losses can add up fairly quickly.

To protect and maintain the integrity of the payment network as a whole, the card brands have created and evolved their own security programs. Specific to the security of mom-and-pop shops, Visa late last year established new requirements for U.S. and Canadian acquirers that provide payment card processing accounts to these merchants. The new mandates take effect Tuesday. 

  • Effective Jan. 31, acquirers must ensure that Level 4 merchants using third parties for point-of-sale (POS) application and terminal installation and integration engage only PCI-qualified integrator and/or reseller professionals (QIR). 
  •  
  • Effective Jan. 31, acquirers must ensure Level 4 merchants annually validate PCI DSS compliance or participate in the Visa Technology Innovation Program (TIP).

There are some exceptions to these requirements, namely that single-use terminal merchants without internet connectivity are considered low risk and therefore excluded.

But what this means for most other Level 4 merchants, and really any merchant, is that there is an increased focus on ensuring data security and working with secure partners

It is worth noting that Visa is offering relief from compliance validation for those merchants that have invested in secure payment technologies, specifically EMV-compliant hardware and/or PCI-validated point-to-point encryption solutions.

We strongly encourage all merchants and payment card-accepting entities to double down on their security efforts and attest to compliance with PCI DSS. And for those that work with third parties on managing or installing their POS systems, only consider a certified PCI QIR professional.

Finally, acquirers should be aware that reporting on compliance for Level 4 merchants is going to be the new norm. We would encourage all acquirers and merchant service providers to ensure they have a PCI compliance program in place for their merchant portfolios.

James Zou is a systems engineer at Trustwave specializing in PCI DSS compliance.

Latest Trustwave Blogs

Unveiling the Latest Ransomware Threats Targeting the Casino and Entertainment Industry

Anyone who has visited a casino knows these organizations go to a great deal of expense and physical effort to ensure their patrons do not cheat. Still, there is a large group of actors who are...

Read More

Third-Party Risk: How MDR Offers Relief as Security Threats Abound

While third-party products and services are crucial to everyday business operations for almost any company, they also present significant security concerns, as high-profile attacks including...

Read More

Trustwave Takes Home Comparably Best Company Outlook for 2024 Award

Comparably, a leading workplace culture and compensation monitoring employee review platform selected Trustwave to receive its Best Company Outlook for 2024 Award. This award marks the seventh time...

Read More