PCI Addresses Payment Security Risks With New Guidance

In August, the Payment Card Industry ("PCI") Security Standards Council published the Third Party Security Assurance Information Supplement ("Supplement") to help organisations reduce their risk by better understanding their respective roles in securing card data.

The Supplement was developed by the PCI Special Interest Group ("PCI SIG") consisting of merchants, banks and third-party service providers, to help meet PCI Data Security Standard ("PCI DSS") Requirement 12.8.

Under PCI DSS Requirement 12.8, an entity must maintain policies and procedures to ensure that service providers are securing cardholder data. In addition, under PCI DSS 3.0, effective from 1 January 2015, entities will be required to obtain a written acknowledgement of responsibility for the security of cardholder data from their service providers.