Winter is Coming… and so is PCI-DSS 4.0

In the world of contact centers and card payments, a day of reckoning is near. The Payment Card Data Security Standard has existed in some iteration since 2004. But PCI-DSS 4.0 is coming in early 2022 – which is months after it was initially expected, since given these complex times, this version requires still more rounds of feedback. What does that mean for your contact center? It means stock up, fortify, and brace yourself – 4.0 is going to be big.

Why is there so much at stake right now in contact centers and card payments anyway?

On the one hand, the last two years of the pandemic have seen a rapid transition to online services. People stuck at home, engaging in all kinds of virtual transactions, has meant a dramatic increase in their interaction with contact centers that are often hybrid workplaces. So, there is greater risk to data privacy, and increased vulnerability to cybersecurity threats, and non-compliance consequences.

On the other hand, the contact center remains as important to a customer’s experience as it always has been. An agent can make or break a customer’s relationship with the company, especially today, in the age of bots, when customers expect better from a human being. The entire live agent experience must be smooth-running, and ideally with minimal disruptions like compliance or security issues.

In short, this combination of conditions, has the potential to create the perfect storm, and PCI-DSS 4.0 will be trying to get in front of it by tightening regulations.

First and foremost, there will be a fundamental change in PCI’s language specifying requirements. No longer will it be about what “must be implemented,” rather it will be about what the resulting security outcome “is.” The focus will not be on requirements, but on outcomes and results – and having the right processes and practices in place to protect customers.

For example, instead of asking companies to run intrusion detection and intrusion prevention systems to protect their networks, they might simply ask companies to ensure they have adequate network security in place—regardless of how they go about it. There is more flexibility in how things get done, but the responsibility is on the company to get them right.

Additionally, PCI will also include requirements to match the evolving security landscape. Although those actual requirements will not be known until the new standards are published, according to a and Sullivan report there are likely to be at least five requirements that will be revised, and they cover everything from protecting cardholder data with cryptography, to supporting information security with policies and programs. This means that even companies that are currently keeping in accordance with the PCI DSS will have to stay on their toes in anticipation of the new version.

With so much brewing on the horizon, it is more important than ever for companies to anticipate and prepare with the right technology. Preparation might include:

• Making sure your recording system has end-to-end encryption at transit and at rest.
• Maintaining strict sign-on and user authentication systems.
• Having different methods for data-masking during the call, along with the capabilities to lock an interaction or delete it.
• Making sure you have advanced role-based access control to manage data, actions, and resources.
• Having the right processes in place so if there ever is a breach, corrective action can immediately unfold after card holder data is exposed.

Remember, future audits and investigations will be best avoided if you can demonstrate proactive measures. Set the processes in place now and show you are working to apply the right technology in order to adhere to regulations and maintain best practices.

As an industry leader, NiCE supports contact centers with a wide portfolio of solutions and the latest security standards. NiCE Compliance Center is a unique end-to-end compliance solution that assures interactions are recorded, stored, and accessible in adherence with specific regulatory requirements and according to the best practices and policies defined by each organization. The solution leverages automation and analytics for PCI DSS compliance.

NiCE Compliance Center provides three layers of protection to manage your compliance needs. It helps you to avoid violations, to discover incidents should they ever actually happen, and to have the tools to then take corrective actions when needed.

No one knows exactly what 4.0 and the future will hold. But with NiCE Compliance Center, you and your customers are better prepared to face the winds of change.

We invite you to read more or book a demo. Just click here and our team will be happy to show you how simple contact center compliance adherence can be.