PCI Certified vs. PCI Compliant: What's the difference, and why does it matter?

Payment and data security has never been more important. As ecommerce purchasing trends continue to dominate the industry, retailers are adapting to ensure that consumer data is protected. This includes merchants updating fraud prevention strategies, implementing modernized payment infrastructure, and governments increasing authentication measures.

This brings up an important topic within the payment security space around PCI certification. You may notice that some companies within the point-of-sale (POS) industry are PCI certified, while others are PCI compliant. Because of the importance of data security for the sustainability of POS organizations, understanding the difference in PCI certification types and why it matters is important for the health and longevity of your organization.

What does it mean to be PCI Certified?

The Payment Card Industry Data Security Standard (PCI DSS) is maintained by the Payment Card Industry Security Standards Council (PCI SSC), a global forum that brings together payment industry stakeholders to develop and drive adoption of data security standards and resources for safe payments worldwide.

In short, PCI certification verifies that an organization contains the technical requirements which protect and secure payment card data during processing, handling, storage, and transmission. Following PCI security standards is just good business, as they help ensure healthy and trustworthy payment card transactions for the hundreds of millions of people worldwide that use their cards every day.

Being PCI Certified provides multiple benefits to both the organization that is certified, as well as their partners and customers:

Provides Peace of Mind: The main reason why PCI DSS was created was to reduce the risk of data breaches from occurring. Requiring merchants to take measures such as using firewalls and encryption, and prohibiting the storage of cardholder information, not only makes it harder for hackers to break in, but also reduces the amount of sensitive data they can steal.

Helps Avoid Fines: If you have not taken the extra steps to protect yourself, you are at a much higher risk for cyber-attack and may face fines and lawsuits from customers or other organizations that were impacted.

Protects and Builds Trust with Your Customers: Trust should be the foundation of your business. Your customers want to know that you have their back - and having the PCI certified stamp of approval shows your commitment to securely transmitting and processing their payment details.

What is the difference between being PCI Certified and PCI Compliant?

When an organization is PCI compliant, this means that they have taken steps to protect card holder data by following the guidelines set by the PCI SSC. To become compliant, organizations fill out a self-assessment questionnaire to ensure that they are complying with PCI guidelines.

On the other hand, PCI certification is a rigorous process involving a comprehensive audit by a qualified security assessor (QSA). During this process, the QSA reviews all areas of your business related to card holder data and checks to ensure that the proper security measures are in place to protect customer information. To become PCI certified, the QSA reviews how your software is developed, how your developers are trained, as well as the technical procedures and controls of your software.

While the self-assessment questionnaire and the PCI certification processes are similar, the main difference is that to become PCI certified, you have the QSA providing proof of your software and process, whereas for PCI compliant organizations, your claims have not been proven.

VIGILIX: The Only PCI Certified Remote Monitoring and Management Platform for POS

VIGILIX is the only PCI certified, remote monitoring and management (RMM) platform built specifically for point-of-sale. In fact, no other remote-control platform has passed the PCI-DSS security review. With built-in multi-factor authentication, secure password management, and audit reports, VIGILIX helps you meet and exceed security requirements for PCI regulations with the click of a check box. By partnering with VIGILIX, you have the ability to resell our PCI Certified Remote Access to your end-users through a simplified interface, at no additional cost to you.

About VIGILIX

For more than 15 years, VIGILIX has been delivering technologies to enable companies to succeed at remotely supporting the point-of-sale environment.

Our industry-specific technology detects service issues, initiates corrective actions, and alerts support managers to changing conditions immediately. Support teams, in turn, use our platform to access and control the POS systems from any location and any time safely and securely. Companies also use our platform to automatically back up copies of their critical POS system data at our secure, PCI-compliant off-site data centers.

We are a privately held, entrepreneurial company that has grown organically without the pressures and influences of outside investors. We believe in this: to do the right things and do things right.