National Cash Management Systems
CISP and PCI Security Standards
All products offered through National Cash Management Systems (NCMS) comply with both Cardholder Information Security Program
(CISP) and
Payment Card Industry (PCI) security standards, affording merchants the highest level of data and payment security available.
CISP compliance is required of all merchants and service providers who store,
process, or transmit Visa cardholder data. The program applies to all payment
channels, including retail (brick-and-mortar), mail/telephone order, and
e-commerce. To achieve compliance with CISP, merchants and service providers
must adhere to the Payment Card Industry (PCI) Data Security Standard, which
offers a single approach to safeguarding sensitive data for all card brands.
PCI consists of 12 technology requirements regarding security:
PCI Data Security Standard
|
Build and Maintain a Secure Network
|
- Install and maintain a firewall configuration to protect data
- Do not use vendor-supplied defaults for system passwords and
other security parameters
|
Protect Cardholder Data
|
- Protect stored data
- Encrypt transmission of cardholder data and sensitive
information across public networks
|
|
Maintain a Vulnerability Management Program
|
- Use and regularly update anti-virus software
- Develop and maintain secure systems and applications
|
|
Implement Strong Access Control Measures
|
- Restrict access to data by business need-to-know
- Assign a unique ID to each person with computer access
- Restrict physical access to cardholder data
|
|
Regularly Monitor and Test Networks
|
- Track and monitor all access to network resources and
cardholder data
- Regularly test security systems and processes
|
|
Maintain an Information Security Policy
|
- Maintain a policy that addresses information security
|
This standard resulted from collaboration between Visa and MasterCard to
create common industry security requirements, incorporating the CISP
requirements. Other card companies operating in the U.S. have also endorsed the
PCI Data Security Standard within their respective programs.
Using the PCI Data Security Standard as its framework, CISP provides the
tools and measurements needed to protect against cardholder data exposure and
compromise across the entire payment industry.
|