PCI Compliance and Cyber Insurance: Protecting Customer Payment Data

The Payment Card Industry Data Security Standard

PCI DSS is a set of security standards designed to ensure all companies that process, store, or transmit credit card information maintain a secure environment. Non-compliance can result in:

• Fines from $5,000 to $100,000 per month
• Increased transaction fees
• Loss of card processing privileges
• Liability for fraud losses
• Reputational damage

PCI DSS Requirements Overview

The 12 Requirements:

1. Install and maintain a firewall configuration

2. Change vendor-supplied default passwords

3. Protect stored cardholder data

4. Encrypt transmission of cardholder data

5. Use and regularly update anti-virus software

6. Develop and maintain secure systems

7. Restrict access to cardholder data

8. Assign unique IDs to each person with access

9. Restrict physical access to cardholder data

10. Track and monitor all access to network resources

11. Regularly test security systems and processes

12. Maintain an information security policy

Compliance Levels

Your compliance requirements depend on transaction volume:

LevelAnnual TransactionsRequirements

1Over 6 millionAnnual on-site audit, quarterly scan

21-6 millionAnnual self-assessment, quarterly scan 320,000-1 million e-commerceAnnual self-assessment, quarterly scan 4Under 20,000 e-commerce, up to 1 million otherAnnual self-assessment, quarterly scan recommended

Common Retail Vulnerabilities

Point of Sale (POS) Systems

• Outdated software and operating systems
• Default passwords unchanged
• Unencrypted data transmission
• RAM scraping malware

Network Security

• Unsecured Wi-Fi networks
• Flat network architecture
• Inadequate firewall configurations
• Missing intrusion detection

Employee Practices

• Shared login credentials
• Inadequate training
• Social engineering susceptibility
• Physical security gaps

Third-Party Risks

• Vendor remote access
• Integrated systems
• Cloud service providers
• Payment processors

Cyber Insurance for Retail

First-Party Coverages:

Data Breach Response

• Forensic investigation costs
• Legal counsel
• Notification expenses
• Credit monitoring services
• Public relations support

Business Interruption

• Lost revenue during system downtime
• Extra expenses to maintain operations
• Contingent business interruption

Cyber Extortion

• Ransomware payments
• Negotiation services
• System restoration

Data Restoration

• Costs to recreate lost data
• System reconstruction
• Software replacement

Third-Party Coverages:

Privacy Liability

• Defense costs for privacy claims
• Regulatory proceedings
• PCI fines and assessments
• Customer lawsuits

Network Security Liability

• Claims from security failures
• Transmission of malware
• Denial of service attacks

The Real Cost of a Breach

Average costs for retail data breaches:

Cost ComponentPer Record10,000 Records

Detection and escalation$29$290,000 Notification$27$270,000 Post-breach response$41$410,000 Lost business$79$790,000 Total$176$1,760,000

These figures don't include PCI fines, which can add significantly to total costs.

Building a Compliance Program

Step 1: Scope Assessment

Identify all systems that:

• Store cardholder data
• Process cardholder data
• Transmit cardholder data
• Connect to systems that handle card data

Step 2: Gap Analysis

Assess current state against requirements:

• Network security review
• Policy and procedure evaluation
• Employee training assessment
• Vendor management review

Step 3: Remediation

Address identified gaps:

• Technology improvements
• Policy development
• Training programs
• Vendor contracts

Step 4: Validation

Complete required assessments:

• Self-assessment questionnaire
• Vulnerability scans
• Penetration testing (if required)
• On-site audit (Level 1)

Step 5: Ongoing Maintenance

Maintain compliance continuously:

• Quarterly vulnerability scans
• Annual assessments
• Continuous monitoring
• Regular training updates

Quick Wins for Small Retailers

Immediate steps to improve security:

1. Update all POS software and systems

2. Change all default passwords

3. Enable encryption on card readers

4. Segment payment systems from other networks

5. Implement employee training

6. Review vendor access controls

7. Enable logging and monitoring

Insurance Application Tips

To get the best cyber insurance terms:

• Demonstrate PCI compliance
• Document security training
• Show incident response plans
• Highlight security investments
• Disclose any prior incidents honestly

Core Brokers helps retail and hospitality clients achieve PCI compliance and secure appropriate cyber insurance coverage. Contact us for a cyber risk assessment.