Gregory Gevorkyan

Payment Card Industry Data Security Standard (PCI DSS) compliance is essential for any organization that handles credit card transactions. It ensures that sensitive cardholder information is protected and secure, helping to build trust with customers and partners. The PCI DSS framework consists of 12 requirements, divided into six logically related groups called "control objectives." Let's explore these requirements in detail:

Install and Maintain a Firewall Configuration to Protect Cardholder Data

Firewalls act as barriers between trusted internal networks and untrusted external networks, such as the internet. To protect cardholder data:

Establish and implement firewall and router configuration standards.

Identify all connections to cardholder data and ensure appropriate firewall configuration.

Regularly review and test configurations and firewall policies to ensure they are up-to-date and effective.

Do Not Use Vendor-Supplied Defaults for System Passwords and Other Security Parameters

Default passwords and settings provided by vendors can be easily exploited by attackers. To mitigate this risk:

Change all default passwords upon installation of systems.

Use strong, unique passwords for all accounts and systems.

Implement and enforce a password policy to ensure continued use of strong authentication credentials.

Stored cardholder data must be protected through encryption and other methods to prevent unauthorized access. Key measures include:

Encrypt cardholder data using strong cryptography.

Minimize storage and retention of cardholder data to only what is necessary.

Implement secure deletion methods for data that is no longer needed.

Encrypt Transmission of Cardholder Data Across Open, Public Networks

Data should be encrypted when transmitted over public networks to prevent interception and unauthorized access. Steps to achieve this include:

Use strong encryption protocols (e.g., TLS) to secure data in transit.

Implement proper key management practices for encryption keys.

Ensure secure transmission methods are in place for all cardholder data exchanges.

Protect All Systems Against Malware and Regularly Update Antivirus Software or Programs

Systems must be protected against malware with the latest antivirus software and other protective measures. This involves:

Installing and maintaining up-to-date antivirus software on all systems.

Conducting regular malware scans and responding to detected threats promptly.

Ensuring antivirus definitions and software are updated regularly.

Develop and Maintain Secure Systems and Applications

Organizations need to implement secure coding practices and conduct regular security testing to protect against vulnerabilities. Key practices include:

Following secure development guidelines and best practices.

Conducting code reviews and vulnerability assessments on applications.

Applying security patches and updates promptly to mitigate identified vulnerabilities.

Restrict Access to Cardholder Data by Business Need to Know

Access to sensitive information should be limited to individuals who need it to perform their job duties. This involves:

Implementing role-based access control (RBAC) to restrict access.

Regularly reviewing and updating access permissions.

Ensuring that access to cardholder data is granted only to authorized personnel.

Identify and Authenticate Access to System Components

Access controls must be established, including unique IDs and passwords, to ensure that only authorized individuals can access system components. Important measures include:

Implementing strong authentication mechanisms, such as multi-factor authentication (MFA).

Ensuring unique identification for each user and device accessing the system.

Regularly reviewing and updating authentication protocols.

Restrict Physical Access to Cardholder Data

Physical security measures should be in place to protect cardholder data from unauthorized physical access. This includes:

Securing physical access to sensitive areas and data storage locations.

Implementing access controls such as key cards, biometrics, or security guards.

Monitoring and logging physical access to sensitive areas.

Track and Monitor All Access to Network Resources and Cardholder Data

Monitoring and logging mechanisms should be implemented to track access to network resources and cardholder data, ensuring accountability. Key steps include:

Implementing logging mechanisms to capture access and activity logs.

Regularly reviewing logs for suspicious or unauthorized activity.

Ensuring logs are stored securely and retained for a specified period.

Regularly Test Security Systems and Processes

Organizations should regularly test their security systems and processes to identify vulnerabilities and ensure compliance with security standards. This involves:

Conducting regular vulnerability scans and penetration tests.

Performing security assessments and audits.

Implementing a continuous improvement process for security practices.

Maintain a Policy That Addresses Information Security for All Personnel

A comprehensive information security policy should be established and maintained, outlining security protocols and responsibilities for all personnel. This includes:

Developing and implementing an information security policy.

Providing regular security training and awareness programs for employees.

Ensuring that all personnel understand their roles and responsibilities in maintaining security.

Achieving and maintaining PCI compliance is crucial for protecting cardholder data and ensuring customer trust. Implementing these 12 requirements creates a robust security foundation, but it can be complex and steal precious engineering and operational resources from your team.

For a more efficient path to PCI compliance, Modernbanc offers a Vault solution that helps simplify the compliance process, integrate seamlessly with your systems, and provide robust security measures. Learn more about how Modernbanc can support your PCI compliance journey at 

Understanding PCI Compliance: A Comprehensive Guide to the 12 Requirements

We rewrote our UI sync engine making it a lot smoother and more performant. You’ll notice a significantly more stable experience across the app.

We revamped our frontend SDKs allowing for more granular styling and design control. Our new 

 a Stripe-like experience with spaces between zeroes in card number or month/year separation.

We decoupled our Element UI from the main UI allowing for a 10x faster load and browser caching.

You can now set-up Modernbanc workflows to act as 

 and forward sensitive PCI and other data.

We've been quietly building the best in-class tool for reconciliations, reporting and financial ETL that's natively integrated with your ledger data. Stay tuned for further updates!

Made all list endpoints and UI pages load 10x faster.

You can now copy your workspace id in Settings

Various bug fixes and improvements across the UI.

Product Update - May 2024

Payment Card Industry Data Security Standard

 (PCI DSS) is a set of data security standards that all organizations that store, process or transmit cardholder data are required to comply with.

To help ensure that this sensitive data is handled safely and to protect the cardholders, who take on a risk when they use their card in stores and purchase things online.

If at least one of those providers (ATMs or card machines) are compromised, an attacker can see your 

 (PAN, a.k.a card number), expiry date, and cvv and would then be able to make fraudulent payments.

PCI DSS applies to all organizations that accept or process cardholder data, regardless of the size of the company or the industry it serves.

Even if you're not a payment processor (e.g merchant, data vendor, etc)

What happens if my organization doesn't comply?

Fines vary from $5,000 to $100,000 per month until the merchants achieve compliance. These fines are manageable for a big bank, but it could easily put a business into bankruptcy.

Fines from card networks (Visa, Mastercard, Amex)

$5,000 to $100,000 per month until compliance is achieved

In case of data breach costs can significantly increase. These can include fines per cardholder data compromised, which can range from 

There can also be additional fines for violations of compliance standards, which can exceed millions of dollars.

Your bank or payment processor (e.g Stripe) may choose to offboard you and terminate your access to their payment services.

 taken by consumers or other parties involved.

How can I make my organization PCI compliant?

Build it yourself and go through certification

 in development cost on lowest transaction tier not including maintenance. This effort can consume all your company resources.

You’ll have to build encryption infrastructure from scratch. This includes but is not limited to embedding advanced algorithms, building network isolation, VPC-peering, encryption key ring management and rotation, and incorporating mTLS with some providers (e.g. Visa).

PCI is a hassle to manage not just for a startup but for big companies too. For example, 

 had a 3 day outage because the key rotation service bugged out and the only person who understood it was on vacation.

Offload the burden of processing card data

Offboard the burden by letting a PCI-certified entity handle your card data processing. The key here is that your team and your servers never get exposed to or touch underlying card data.

By offloading the storage and processing of card data, you reduce your burden by 

 to basic organizational controls such as:

Script and Code Dependency Inventory Management

Modernbanc provides an end-to-end environent and a 

 to either fully offboard PCI card data processing burden or partially alleviate it.

We can help you launch in minutes while you still keep full control of your data.

Operate at any level of abstraction from deploying your own code to manipulating data with our low-code UI editor.

Control your data like it's in-house!

From payments processors: read APIs, emails or SFTP with our 

Directly: create in Modernbanc UI or post with the 

Process your card data like it's in-house.

 From our low-code Workflows editor to deploying your own code on Modernbanc Isolates and Docker containers you can operate the data in any way you see fit without exposing it to your app or servers.

Integrate any processor, make payments and send data with our 

Why you need to be PCI-compliant.

To protect customer cardholder data and promote higher authorization rates card networks introduced network tokens, a technology supported by the 

Network tokens are digital and dynamic representations of a payment card's details like card number Network tokens are digital representations of a payment card's details like card number (

) or expiry date. Created and managed by card networks like Visa and Mastercard, these tokens replace sensitive card information during transactions, enhancing security and reducing the PCI compliance burden on businesses.

Network Tokens are dynamic and auto-updated; for example, if a card is lost or stolen, the card issuer notifies the card network, which links updated card details to the existing Network Token, allowing merchants to not worry about payment declines.

In 2014, Apple Pay introduced one of the 

 uses of network tokenization in payment processing, using unique, transaction-specific tokens to secure payment data, reducing credit card fraud risk.

Following Apple Pay, Visa, MasterCard, and American Express expanded tokenization, establishing standards for token management. 

Mastercard's Digital Enablement Service (MDES)

 provided infrastructure for secure payment token issuance and management, enhancing digital payment security.

: Unlike traditional card numbers, network tokens are not static and can be dynamically updated, making them less attractive targets for fraudsters.

: For the same reason as above - if customer card is expired or lost network token is proactively updated. As a result both merchants and users enjoy simplified payments experience for recurring transactions.

: The card schemes generally offer a lower fee for tokenized transactions. The number will depend on your payment provider, but it can be up to 0.1% per transaction.

While network tokens offer significant advantages, not all payment processors and gateways support them. To utilize network tokens, businesses must either partner directly with card networks or work with providers like 

However in order to create a token you need to pass sensitive card data to these entities, which means your business must first achieve PCI compliance, a costly and time-consuming process.

How Modernbanc helps with Network Tokens.

 Vault provider, provides a partner-agnostic solution allows you to avoid vendor lock-in and integrate with any network token provider.

Leverage your own Visa/Mastercard partnerships and use Modernbanc to collect and manage card details from your customers, pass them to your card networks and exchange them for a network token.

Integrate with a third party Network Token provider.

Use Modernbanc to compliantly collect cardholder data and create and manage network tokens with providers like 

What are TRIDs (Token Requestor Identifier) and do I need them?

 is a unique identifier assigned to entities that request tokens on behalf of cardholders in the context of network tokenization. You need to have a TRID in order for networks to identify you for security purposes.

You can typically obtain either via third party providers like Cybersource (faster approach) or directly with card networks (e.g Visa/Mastercard) after going through their onboarding and partnership process.

If you're planning to partner directly with card networks we're happy to assist and facilitate that discussion.

Yes - in their tokenized form they're not considered PCI-sensitive data. Therefore you can store and operate them on your systems.

How does Modernbanc help with Network Tokens?

You need to collect cardholder data in order to exchange it for a network token and in order to do so you have to be PCI-compliant.

Modernbanc provides out-of-the-box PCI-compliant infrastructure that allows you to compliantly collect and process cardholder data along with sending it to your Network Token Provider.

How do I get started with Network Tokens on Modernbanc?

In the simplest cases, building a network token implementation for your platform can take minutes. Regardless of the path you choose, we'll help you design your architecture and understand which provider to use.

What are network tokens?

In 2018, the European Union passed the General Data Protection Regulation (

), one of the most strict and far-reaching data privacy rules in the world. This legal set of principles regulates how companies collect, use, and store the data of European citizens, regardless of where the company is located.

Your business might not specifically market your products and services to EU citizens, but if a citizen 

, you’re still responsible for complying with the GDPR.

Under this law, individuals, also called data subjects, have a right to be informed about any processes pertaining to how their personal data is collected, accessed, rectified, restricted, and erased. Perhaps most importantly, businesses must gain the consent of data subjects before collecting any data.

The GDPR is over 85 pages long so staying in compliance can be challenging. Regardless, you can’t ignore this regulation; one of the consequences of non-compliance is a sizable 

.
For the most severe infringements, your business can be fined up to €20 million or 4% of your annual worldwide revenue. The biggest fine to date was charged to Meta in 2023, coming in at 

 for incorrectly transferring European data to the United States. Here’s a breakdown of the GDPR and how Modernbanc can help you with your data processing needs.

If your company processes data, you must operate within the 7 principles of GDPR:

Principle 1: Lawfulness, fairness and transparency

Users should never be in the dark about why you’re collecting their data, who you are, and how you plan to use their data.

You must have a good reason for collecting and processing personal data. This may be to fulfill a contract or uphold a legal obligation. No matter the reason, you also need your data subjects’ consent to use their data.

Once you’ve received user consent to process data, you can’t use the data for another purpose without asking for consent again. In short, avoid the temptation to use data for new reasons without giving your users the chance to assert their rights to their own data and its processing.

The data you collect must be relevant and limited to what’s necessary in order to fulfill your stated purpose. If you don’t absolutely need additional information, like phone numbers, physical addresses, or demographic data, you should not collect and retain that data.

Your business is responsible for the accuracy of the data you have on your users. Establish checks and balances for how you collect, update, and erase data. Your users have the right to ask that any inaccurate or incomplete data be fixed or erased within 30 days.

Don’t keep data for longer than you need it. The GDPR does not set a specific time frame for storage limitation so it’s up to your company to justify your data retention policies. Document how and when you will review the data you hold, including how you will erase or anonymize your data once it’s no longer needed. Staying compliant with this principle will help you stay compliant with the data minimization principle.

Principle 6: Integrity and confidentiality (or principle of security)

Your company is responsible for avoiding data breaches, both online and at your physical and organizational levels. Ensure that data can only be accessed by authorized individuals and that you have critical safeguards like cybersecurity certifications, secured facilities, encrypted data, and data backups.

Your company is responsible for the data you collect and your compliance with all 7 GDPR principles. Study security practices, keep an inventory of your data, secure consent from users, and perform regular assessments of your data policies on a regular basis. Show individuals that you respect their rights and take their data protection seriously.

What are the 2 main roles and responsibilities in GDPR compliance?

If your company is in charge of determining the purpose of the data you’re collecting, processing, and storing, then you qualify as a data controller. In short, you’re in charge and responsible for processing activities, even if you use a third party data processor.

It’s your responsibility to choose data processors that can prove they comply with all of the principles and limitations of GDPR, and any other other laws that are relevant to your operations.

A data processor can be a company, legal entity, or an individual that processes data on the behalf of another organization. Even though the data processor doesn’t collect the data itself, it still must maintain records of data and comply with GDPR guidelines.

SaaS and IT solutions are often data processors. They aren’t concerned or involved with the purpose of the data and how it’s processed, but they’re still responsible for protecting the rights of the data subject and ensuring security measures are in place.

How to comply with GDPR when you collect data directly

If you collect data directly from data subjects, you’re responsible for being transparent about why you’re collecting the data and how you intend to use it. You must have a lawful basis, obtain consent from individuals and respect their rights under GDPR, and follow the principle of data minimization.

You’re also responsible for implementing security measures that protect the data you collect. This includes having data processing agreements with all data processors that you use, conducting data protection impact assessments, training your employees on security measures, auditing and reviewing your compliance, and setting procedures for notifying users of a data breach.

How to comply with GDPR if you collect data indirectly via partners

Even if you’re not the party directly collecting data, by processing that data you’re just as responsible for GDPR compliance. Make sure you have data processing agreements in place with your partners and that they have consent from users and a lawful basis for collecting and processing personal data.

The end user must know that the data ends up with you and your partners should reflect that in their Terms agreement with that end user. They must either mention you directly or explain to end-user that their data may be shared with third-party subprocessors and for what purposes, with a link to a page with list of current sub-processors.

If you're acting as a data processor for your partners, it's crucial to have a 

Particularly sensitive data (also known as Special Category Data) requires much stricter security and encryption measures.

ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, health data, sex life or sexual orientation information, and more.

Modernbanc can help you stay GDPR compliant

Modernbanc takes GDPR compliance seriously. We’ve been assessed and certified by independent auditors for 

 as a service enables our customers to collect, process, and share all kinds of sensitive personal data, payment data, and card data.

: To uphold the GDPR principle of security, Modernbanc uses advanced encryption algorithms and procedures. This algorithm uses 256-bit Advanced Encryption Standard (AES-256) keys in Galois Counter Mode (GCM), padded with internal metadata. Modernbanc also ensures network isolation, encryption key ring management and rotation alongside other measures.

: Encryption Vault is designed for extra security, making it a secure and GDPR compliant place to collect and store Special Category Data, which is personal data that holds more risk and sensitivity.

 Encryption Vault also enables your business to stay compliant with the GDPR principle of storage limitation by setting a deletion data to automatically ensure that your data isn’t stored for longer than needed.

Want to hear more about how Modernbanc’s Encryption Vault can help you collect, store, and use data while staying compliant with GDPR?