Features | March 16, 2023

Transactional Security: Defense and Compliance — Part 2

By Alyssa Alford

In a world of e-commerce, client-serving businesses must ensure their entire fulfillment process is secure, from initial client conversations to product delivery. In Part 1, we covered the basics of financial fraud and cybersecurity defense measures. In Part 2, we’ll take a deeper dive into cybersecurity regulation standards and compliance.

SOC 2 Compliance

The Systems and Organizations Controls 2, or SOC 2 report, is designed for technology-based companies to certify high-strength security. Vanta, a security compliance automation service, states “securing a SOC 2 report is the most trusted way to show your customers and prospects that your security practices can protect their data.” Although not technically mandatory, SOC 2 reports have become an expectation for businesses and are a necessity.

There are two types of SOC 2 audits. Type I is the cheapest and fastest of the two and is constructed based on five Trust Services Criteria. However, a Type II audit will provide more information. A SOC 2 Type II report will examine both the structure of your systems and their efficacy, but the process may take up to a year to complete; by comparison, it takes a month or less to complete a Type I audit.

There are five categories judged by SOC 2 that make up the Trust Service Criteria: Security, Availability, Confidentiality, Privacy and Processing Integrity. Every SOC 2 report is unique and built using a combination of Security and a selection of the other four Trust Services Criteria. By focusing on specific areas, you can learn more about where additional information security is needed. The more Trust Services Criteria included, the better the report will look to your clients. Businesses will need to partner with an experienced CPA firm in order to conduct an SOC 2 audit. If you need help considering which categories would fit your needs best, consult this article from A-LIGN.

PCI DSS Compliance

In March of 2022, PCI DSS 4.0 was released with substantial changes. According to securitymetrics, this was done with the following goals in mind.

• Always meets changing payment security needs
• Promotes taking continuous measures in security
• Improves secure methods of validation
• Increases flexibility and support of new methods to reach peak security

Payment Card Industry Data Security Standard (PCI DSS) compliance is structured in four levels based on the number of card transactions completed by a business in a year. This compliance is mandatory for any business or organization that obtains, stores, sends or processes credit and debit card information.

Each PCI DSS level provides a set of requirements to follow to avoid a hefty fine. Depending on your level and the circumstances of your noncompliance, this fine could range from $5,000 to $100,000 monthly. Ensure that your compliance is up to speed at all times by checking your guidelines:

Level 1: Greater than 6 million annual transactions

• Requirements:
  • Completed Attestation of Compliance Form (AOC)
  • Annual PCI DSS audit
  • Quarterly network scans by the Approved Scanning Vendor (ASV)
  • Annual Report on Compliance (ROC) by a Qualified Security Assessor (QSA)

Level 2: 1-6 million annual transactions

• Requirements:
  • Completed Attestation of Compliance Form (AOC)
  • Annual Self-Assessment Questionnaire (SAQ)
  • Quarterly network scans by the Approved Scanning Vendor (ASV)
• Audits are not required; these occur by request of the business, or in response to a hacking event. Some merchants might request a PCI DSS audit as a means of double-checking their security or as a public image boost.

Level 3: 20,000-1 million annual transactions

• Requirements:
  • Completed Attestation of Compliance Form (AOC)
  • Annual Self-Assessment Questionnaire (SAQ)
  • Quarterly network scans by the Approved Scanning Vendor (ASV)
• No audit is performed unless upon request or in the event of a data breach.

Level 4: Fewer than 20,000 annual transactions

• Requirements:
  • Annual Self-Assessment Questionnaire (SAQ)
  • Quarterly network scans by the Approved Scanning Vendor (ASV)
• Audits are not required.
• While not typical, a completed Attestation of Compliance Form (AOC) may be requested.

For additional information on PCI DSS requirements and the updates that have been made in version 4.0, securitymetrics has compiled an excellent chart to break everything down.

Offer Your Clients — and Your Business — Peace of Mind

Security in transactions is a must in this day and age. Don’t give hackers the opportunity to break down your walls; stay up to date on your defense systems. Compliance plays a key role in maintaining proper security and keeping your company running smoothly. By offering a safe space for sensitive consumer data, you aren’t just helping your clients; ultimately, you can save your business from hacking’s devastating impact.

Want to learn more? Check out this article about boosting your reputation through stellar security from PS Magazine.

---

Tags:
Cybersecurity