PCI DSS

Foreshore has been accredited as a PCI DSS Level One Service Provider. This means that we deliver offshore hosting and managed services from a PCI DSS compliant environment. 

There are many elements under the PCI DSS set of requirements and levels of accreditation depend on the number of elements needed.  This can range from a simple self-assessment to a full annual audit answering all of 12 of the required elements.  You can find out more about PCI DSS and the PCI Security Standards Council at http://www.pcisecuritystandards.org/

What is PCI DSS?
PCI DSS (Payment Card Industry Data Security Standard) is an internationally recognised set of requirements for enhancing the security of payment card data. Supported by providers such as Mastercard, Visa and American Express, these measures are designed to protect card data when used online and establish best practice for merchants and service providers.  

The PCI DSS is a prescriptive standard which includes requirements for:

• Security management
• Policies
• Procedures
• Network architecture
• Software design
• Other critical protective measures

What level is Foreshore?
Foreshore has been accredited as a Level One Service Provider, which is the most thorough level of accreditation for Datacentres.  This means that all elements of our security controls are satisfactory to meet the needs of customers requiring PCI compliant hosting.  To maintain our Level One certification, we must undergo an annual audit to ensure that best practice is being followed throughout the company.

According to the latest list of certified service providers, Foreshore is the only one based in the Channel Islands.

What does this mean for customers?
If your business stores or processes cardholder data you will need to be PCI DSS compliant. The fines and charges applied by credit card companies in instances of non-compliance can be severe, not to mention the reputational damage caused by breaches in data security.

The audit process covers everything from network infrastructure to employee screening and can require a great deal of investment and resource to implement. Hosting your equipment within a datacentre which is already compliant will answer many of the infrastructure-based requirements of your PCI audit, leaving you free to concentrate on other aspects.

For example, customers who operate in our datacentre can be sure of physical access security and technical infrastructure delivered at a PCI compliant level. Depending on the scope of your project and the level of your involvement with cardholder data, our accreditation may not answer all of your requirements.  Please check with your independent QSA.

Read what Play.com has to say...

Download our:

PCI DSS Certificate of Compliance
Information Security at Foreshore briefing note