The Payment Card Industry Data Security Standard (PCI-DSS) & PCI Compliant Shredders

The Payment Card Industry Data Security Standard (PCI-DSS) is defined by the payment card industry security standards council and is a security standard across the world. There was a need to prevent credit card fraud and this standard was created to achieve this via increased control of data and its risk of compromise. The standard applies to all organisations that process, store or transmit credit card information from most branded credit cards.

If it’s not critical, merchants are strongly advised not to store and credit card or card holder information. A policy of Restricted Physical Access is of high importance if cardholder data must be stored by a merchant.

Paper shredders and PCI Compliance

PCI-DSS standard shredding involves documents being “Cross-Cut” (multidirectional shredding) to a maximum particle size of 6x35mm, making reconstruction impossible. Strip cut paper shredders are not agreed to be PCI Compliant. To maintain high security levels, cardholder data and information should be destroyed using one of the following methods:

• Cross-Cut Shred paper, incinerate, or pulp hardcopy materials.
• Shred Paper Documents using approved destruction methods & certified shredding services (minimally cross-cut shredding).
• Purge, Degauss, Shred or otherwise destroy electronic media so that cardholder data cannot be reconstructed.
• Destroy Any Computer Hard Drive (shred, crush or degauss using DoD type overwrite processes) disposed of that contained credit card data.

It’s a must to ensure that cardholder data is destroyed as soon as it’s no longer required.

PCI Compliant Paper Shredders: