随着电商、远程办公及外卖平台等消费形态持续蓬勃发展，跨境交易和在线支付的使用率不断攀升，支付卡信息安全变得日益重要。为保护持卡人个人信息，支付卡产业安全标准委员会（PCI SSC）要求所有存储、处理或传输持卡人数据的机构，都必须遵守 PCI DSS 合规要求。
什么是 PCI DSS？
PCI DSS 是 Payment Card Industry Data Security Standards（支付卡产业数据安全标准）的缩写，由国际组织 Payment Card Industry Security Standard Council（PCI SSC）制定并管理，这套标准专为保护支付卡数据免遭未经授权的访问与滥用而设计。PCI SSC 由全球主要信用卡组织组成，包括 American Express、Discover Financial Services、JCB、MasterCard、Visa Inc. 及中国银联。
PCI DSS 标准是一套聚焦于保护上述品牌持卡人信息的行业通用准则，适用于所有存储、处理或传输持卡人数据的机构——凡处理这些品牌支付卡的商户或服务提供商，无论其规模或交易量大小，都必须遵守。
谁需要 PCI DSS 认证？
凡存储、处理或传输持卡人数据的所有机构，都必须遵守 PCI DSS 合规要求。第一步：先确认机构属于商户（Merchant）还是服务提供商（Service Provider）。
商户
接受支付卡付款以换取商品或服务的组织——包括实体门店、在线商店，以及提供可下载虚拟商品或服务的企业。
服务提供商
在其提供的服务中传输、处理或存储支付卡持卡人数据，或能控制、影响持卡人数据安全的机构——包括第三方支付处理机构、支付网关服务商、电子钱包服务商及在线交易平台。提供虚拟主机服务的数据中心与云服务提供商也属于此类。
第二步：确认 PCI DSS 等级。等级一的商户与服务提供商，须由合格安全评估师（QSA）进行现场评估；等级二至四的商户与等级二的服务提供商，可使用 PCI DSS 自我评估问卷（SAQ）进行自我评估，或寻求 QSA 协助，以更快速、准确地完成评估。
谁可以协助 PCI DSS 认证？
QSA（Qualified Security Assessor，合格安全评估师）
由 PCI SSC 授权的专业人员，经过培训与认证，可执行 PCI DSS 评估并出具合规报告（ROC）与合规证明（AOC）。QSA 必须定期更新其资质认证，以掌握最新版本的 PCI DSS。若您的机构属于等级一的商户或服务提供商，则必须由 QSA 进行现场评估。
QSAC（Qualified Security Assessor Company，合格安全评估机构）
聘用 QSA 并提供专业评估与咨询服务的公司。QSAC 可协助您了解 PCI DSS 的具体要求，并指导您建立安全的支付环境。
如何选择 QSA 与 QSAC？
- 访问 PCI 安全标准委员会官方网站，查证已通过认证的 QSA 与 QSAC
- 向已完成 PCI DSS 评估的同行或合作伙伴咨询其经验与推荐
- 查看候选 QSA 与 QSAC 的客户评价与案例，确认其经验与专业能力
- 与多家 QSA 或 QSAC 进行初步咨询，了解其服务范围、费用与工作流程
该怎么做？
PCI DSS 合规评估通常包含四个主要阶段：
1. 准备阶段
范围确认与顾问辅导阶段——初步评估现有安全措施以找出差距，界定评估范围（系统、网络与应用程序），聘请顾问或 QSA，并为员工提供信息安全培训。
2. 数据准备阶段
准备与实施必要的控制措施——制定并更新安全政策与操作规程，收集并整理所有证明合规所需的文档与证据。
3. 评估阶段
由 QSA 进行现场评估——正式评估前先进行内部检查，确保所有问题均已处理，再由 QSA 主导现场评估，验证实际操作与文档记载的一致性。
4. 报告阶段
QSA 撰写合规报告（ROC）与合规证明（AOC）；您将报告提交给支付卡组织或收单机构，并取得 QSAC 颁发的合规认证。
需要多长时间？
从初期环境验证到提供最终报告，取得 PCI DSS 合规认证的整体周期约为三至五个月：
- 准备阶段（1–2 个月）：环境验证确认与顾问咨询阶段
- 数据准备阶段（1 个月）：准备和实施必要的控制措施
- 评估阶段（5–7 天）：由 QSA 进行现场评估
- 报告阶段（0.5–1 个月）：QSA 撰写并提交合规报告与认证
实际周期可能因准备程度、系统与业务的复杂度，以及投入的资源（人力、时间与预算）而有所不同。为确保流程顺利高效：请尽早开始准备、与您的 QSA 保持密切沟通，并在取得认证后持续维护与改进安全措施，以保持长期合规。
费用多少？
首次导入 PCI DSS 合规的预估额外费用：
A. 系统
由于 PCI DSS 的高安全要求，部分系统可能需要分离，以符合每个系统组件仅能有一个主要功能等要求（Req. 2.2.3）。原本部署在同一台主机上的 Web Server、Application Server 与 DB Server 等功能可能需要拆分，因此可能需要额外的服务器设备（可使用虚拟服务器）。此外，也可能需要 NTP Server、FIM Server（文件完整性管理）与 Log Server 等安全组件。
B. 安全设备
为符合 PCI DSS 安全要求，可能需要采购额外的安全设备，例如防火墙等网络安全控制设备（NSCs）、入侵防御系统（IPS）、入侵检测系统（IDS）及 Web 应用防火墙（WAF）。
C. 数据加密设备
视您的环境而定，可能需要数据加密设备及相关控制措施，以保护存储的持卡人数据。欢迎联系我们的顾问，为您的环境提供详细的评估报价。
D. Personal Training
PPCI DSS mandates training for personnel including awareness training, secure coding training, and conducting drills for Incident Response Plans (IRP). If staff perform Vulnerability Scans or Penetration Tests, they will also require adequate security training, potentially increasing training costs.
E. Technical Test
PCI DSS requires various periodic technical tests including Internal Vulnerability Scans, External Vulnerability Scans (ASV), Internal and External Penetration Tests, Wireless Scans, Card Number Scans, and Code Reviews. This section typically incurs additional expenses.
F. Other
If you are a service provider, acquiring institutions or card organizations may require registration in their service provider registries like VISA Registry or MasterCard SDP (Service Provider Registration).
For a small to medium-sized Service Provider without prior PCI DSS compliance experience, the estimated additional expenses might include as listed below:
PCI DSS Certification Costs?
In addition to the potential additional costs mentioned above, the cost of PCI DSS Assessment can be varied with the time required by PCI DSS QSAs to complete the Assessment and Report.
The estimated assessment time depends on the following factors:
1. System Complexity: The number of hosts, types of operating systems used, components installed on systems, multiple OS configurations, and security configurations all affect the sampling required during audits and increase audit time.
2. Security Equipment and Networks: The number of security devices within the assessment scope such as Firewalls, IPS, IDS, WAF, Switches, Routers, SIEM, DRP, etc., requires configuration, updates, access control checks, logging, and more, thereby increasing assessment time with more devices and complex network planning.
3. Connections to Acquiring Institutions and Service Providers: More connections to acquiring institutions and service providers form more complex data flows (Dataflows), necessitating additional time for inspection.
4. Database and Card Data Storage and Encryption Methods: Diverse card data flows and storage methods require more encryption or security measures, resulting in additional inspection items.
5. Number of Operational Units: The number of stores, data centers, and operational offices increases the days required for Assessment, e.g., banks, telecom companies, and businesses with numerous stores and offices with extensive sampling. Moreover, backup data centers storing card data are also included in the scope.
Generally speaking, PCI DSS Assessment costs vary by region due to different annual fees set by the PCI SSC and varying salaries for QSAs in different regions. In Southeast Asia, e.g., a small to medium-sized service provider requires 3-5 days for on-site Assessment and around a week for report compilation. Excluding travel costs, PCI DSS certification costs typically range between NT$400,000 to NT$600,000.
However, an actual quotation depends on the complexity factors mentioned above.
Whether you are a cross-border e-commerce business, a third-party payment platform, or a service provider, adhering to PCI DSS compliance requirements is crucial. Implementing these compliance measures not only provides your acquiring bank and regulatory authorities with a certificate of compliance but also directly helps your business reduce the risk of data breaches and theft while enhancing consumer confidence in the security of their transactions.
PCI DSS compliance consists of over 400 requirements, covering everything from understanding and interpreting the standards, providing evidence, and obtaining certification, to maintaining compliance in the future. How do you ensure ongoing compliance?
It is recommended to consider hiring a QSAC (Qualified Security Assessor Company) to help you quickly and effectively achieve compliance in a short time.
After certification, you can utilize a compliance management system offering features such as automated monitoring, alerts, regular data submission, and real-time visual status updates. This ensures that your business remains compliant and secure at all times.