PCI Compliance Guidelines for Working at Home

What Requirements are Needed for PCI Compliance?

PCI compliance is adherence to a set of security standards of the Payment Card Industry Data Security Standard (PCI DSS). All companies that accept, process, store, or transmit credit card information have to be PCI compliant to ensure optimal security.

While it is challenging to enforce PCI compliance on home workers, it is not impossible. The most effective way to ensure that remote workers meet the strict requirements of PCI is to make use of professional work from home solutions as an alternative to the cleanroom technique.

PCI requirements include:

• System protection with firewalls: Configuring firewalls protects your card data environment and restricts incoming- and outgoing network traffic.
• Password configuration and settings: Change default usernames and passwords from vendors as they are easy to guess. Some passwords are also easy to find on the internet.
• Protection of stored cardholder data: Use industry-accepted algorithms, such as AES-256. to encrypt cardholders’ stored data. Additionally, the encryption keys should be protected with an encryption key management process.
• Cardholder data transmission encryption: Encrypt cardholder data before transmitting data across open networks to processors or backup servers.
• Using and regularly updating anti-virus software: Maintaining updated anti-virus or anti-malware programs will prevent malware attacks and security breaches.
• Regularly updating and patching systems: Patch all card flow pathway components on a routine basis, including internet browsers, application software, operating systems, and POS terminals.
• Restricting access to cardholder data by a business’s need-to-know: A role-based access control system is necessary to grant card information access on a need-to-know basis.
• Assigning a unique ID to each person who has computer access: Groups of employees should not share login details and passwords, and computer access should require multi-factor authentication.
• Restricting physical access to workplace and cardholder data: Data theft can be a physical activity that happens during business hours when employees are not paying attention.
• Implementing log management: System event logs record activity on computers, firewalls, and printers. Reviewing these logs daily will help to detect suspicious activity.
• Carrying out vulnerability scans and penetration tests: Regular scanning and testing will reveal defects that leave systems vulnerable to attackers.
• Documenting and assessing security practices: An organization should always document security policies and procedures to verify the implementation of the necessary controls.

What Qualifies as a PCI Violation?

Technically, non-compliance with the Payment Card Industry Data Security Standard does not constitute a violation. The PCI DSS is not a law, but a set of standards that card brands, merchant banks, and payment processors drew up and enforce. If organizations do not meet the requirements for PCI compliance, they may have to pay a fine that the payment brands determine.

The objective of the PCI DSS is to achieve and maintain credit and debit card information, and customer data security.

PCI violations include the following:

• Insufficient protection of usernames and passwords of accounts that contain payment data.

• Failing to maintain a cleanroom environment and making sensitive information accessible to the public, for example, leaving a cardholder’s name and credit card number in a non-authorized view such as on a desk or computer screen. Reading the information out loud over the phone where unauthorized persons can hear it is also a PCI violation.

• Storing documents containing credit card information in unsecured locations, for example, in an unlocked cabinet.

• Connecting the organization’s electronic point-of-sale system with other systems or devices that can obtain customer data and payment card information.

Remote agents who are working from home are at a higher risk of violating PCI compliance than employees who are working at the contact center.

What is the Most Common PCI Violation for Remote Staff?

The number of financial institution employees who are working from home increases every year. There are several benefits to having remote agents working from home. Working hours are more flexible, remote workers cost organizations less in terms of floor space and equipment, and a remote worker who is working from home can be more productive because there are no office distractions.

Despite the advantages of working from home, a remote worker is less likely to be PCI compliant than one who works in a contact center. When remote workers are at home, contact center managers cannot ensure that they stick to best practices and PCI compliance.

The most common PCI non-compliance for home workers is failing to maintain a cleanroom environment. Remote workers may regard their homes to be safer than the contact center and be more careless when dealing with credit card numbers and other sensitive information.

Attackers also know when home workers transition from a contact center, and they may try to get information like credit card numbers from remote workers who do not pay attention to PCI compliance. Stealing data from a contact center is typically more difficult as it is easier for managers to enforce PCI compliance.

How Can You Avoid PCI Compliance Violations with Remote Staff?

Work-from-home solutions incorporate advanced technology to ensure a compliant work environment for remote agents. As a result, it is no longer necessary for home workers to continually monitor the contact center email address or other platforms. These solutions also make it possible for home workers to work securely from any place.

Because these solutions eliminate the need for constant monitoring, it increases the employee’s productivity, and it takes the monotony out of their activities, which increases job satisfaction.

Some solutions have built-in features that also eliminate the need for the agent to deal with the customer’s private data in the first place. This feature mitigates the risk of a CPI violation significantly, whether the agent is at home or in the contact center.

In addition to limiting contact with customers’ personal information, these solutions also allow for safe, PCI-compliant transactions from any place. These solutions also promote the delivery of high-quality customer service while securing their data.

As the number of employees who work remotely increases, companies are increasingly turning to PCI-compliant solutions. This technology includes cloud-hosted DTMF suppressing solutions that allow the agent to pay attention to the customer’s needs instead of information processing and retaining sensitive information.

Additionally, work-from-home solutions make it possible for all agents to provide consistent customer experience, regardless of where they work. Implementing these solutions is quick and easy, and they make it possible for an organization to benefit from remote working without worrying about PCI compliance.

What Does a PCI-Compliant Home Office Setup Look Like?

The primary requirement for remote workers’ office is a PCI-compliant tech solution. Many organizations try to implement a cleanroom policy, but this is difficult to achieve without a manager who is present.

In addition to a compliant tech solution, the agent needs a comprehensive security system and policy that makes provision for desktop locking software, frequent password changes, and the implementation of multi-factor authentication. Additionally, the agent’s system should have the necessary tools to carry out regular security risk assessments.

A home office setup should also include the necessary hardware and software for video conferencing. Optimal channels of communication are crucial to providing agents with training, guidance, and a mechanism to provide feedback. Video conferencing will also make it easier to update employees on security policies and ensure that they follow best practices while working remotely.

A PCI-compliant home office should also have physical security to prevent the theft of documents that contain sensitive information. The employee should have a lockable cabinet to store documentation as well as a shredder to dispose of information that the organization no longer needs.