ThreatDefence becomes PCI DSS compliant

We’d like to announce that ThreatDefence is now PCI DSS compliant! Many thanks to everyone involved for the continued effort and dedication.

What PCI DSS Covers

The Payment Card Industry Data Security Standard (PCI DSS) is maintained by the PCI Security Standards Council. It sets security requirements for organizations that store, process or transmit payment card data.

The requirements cover areas such as network security, access control, logging and monitoring, vulnerability management and regular security testing. Meeting them involves documented controls and ongoing evidence, rather than a single project.

What It Means for Customers

Retailers, hospitality groups and other businesses that take card payments need to know how their security providers handle sensitive data. A monitoring provider sees logs and alerts from the environments it protects, so its own controls matter.

ThreatDefence documents its compliance scope in its legal and compliance documentation, where PCI DSS sits alongside ISO/IEC 27001 and SOC 2. The scope covers the platform, its supporting infrastructure and the 24x7 SOC operations. Further detail on how customer data is protected is in the ThreatDefence Trust Center.

Monitoring and PCI DSS Logging

PCI DSS also expects organizations to log and review access to systems in scope and to detect suspicious activity. A security operations service can support that work by collecting the relevant events, retaining them, and investigating alerts around the clock, while the organization keeps responsibility for its own compliance.

Related Reading

• Retail Cyber Security in Australia explains how POS systems, customer data and online stores can be monitored.
• Cyber security for retail describes how ThreatDefence supports retail organizations.