Retail, Restaurants and Hospitality
Security for retailers, restaurants and hospitality groups
Every location that takes cards is in scope for PCI DSS, and point-of-sale systems, guest Wi-Fi and back-office PCs often share a network. We help operators reduce their card data scope, protect each location and keep evidence for their processor.
- Card standard
- PCI DSS v4.x
- Scope
- Systems that touch or can affect card data
- Main risk
- Point-of-sale compromise and fraud
- Where to start
- Network separation at each location
At a glance
Retailers, restaurants and hospitality groups that accept payment cards must meet PCI DSS for every system that stores, processes or transmits card data or can affect its security. CyberAccord helps operators shrink that scope, separate payment systems from guest and office networks, protect each location's devices, and prepare the evidence processors request.
PCI DSS
The obligations you face
Each point below rests on a primary source. Follow the link to read the rule itself.
Card acceptance puts you in PCI DSS scope
PCI DSS applies to all entities that store, process or transmit cardholder data, and to those whose systems can affect the security of that environment. How you validate compliance, by self-assessment or otherwise, is set by your acquirer and the card brands.
SourcePCI Security Standards Council: PCI DSS (opens in a new tab)
Keep only what you need, and protect what you keep
The FTC's guidance for businesses rests on five principles: know what personal information you hold, keep only what you need, protect it, dispose of it properly, and plan for incidents. Loyalty programs, reservations and online orders all collect data that falls under it.
SourceFTC: Protecting Personal Information, A Guide for Business (opens in a new tab)
Store credit cards make you a financial institution
A retailer that extends credit by issuing its own credit card directly to consumers is a financial institution under the FTC Safeguards Rule. That brings a written security program, a Qualified Individual, encryption and multi-factor authentication for systems holding customer information.
Source16 CFR 314.2 (FTC Safeguards Rule) (opens in a new tab)
Sources last reviewed . This page explains obligations in general terms and is not legal advice.
Recommended services
What we recommend
Three services, most relevant first, chosen for the obligations above.
- 1 · Managed Security ServicesManaged SecurityManaged endpoint, email, and cloud security, with a team that monitors alerts and responds to incidents for you.
- 2 · Penetration TestingPenetration TestingManual, senior-led penetration testing of web apps, APIs, mobile apps, and networks, with prioritized findings and a re-test of fixes.
- 3 · Cloud SecurityCloud SecurityAWS and Azure security assessments and architecture reviews that find misconfigurations and give you a prioritized plan to fix them.
Frameworks that apply
FAQ
Sector questions, answered
Does using a payment processor take us out of PCI scope?
It can reduce your scope a great deal, especially with point-to-point encryption or a hosted payment page, but it rarely removes it. You still have to protect the devices and networks around payments and validate compliance as your processor requires.
Should guest Wi-Fi share a network with our registers?
No. Put guest Wi-Fi, payment systems and back-office computers on separate networks so a compromise on one cannot reach the others. This is also one of the most effective ways to reduce PCI DSS scope.
We run many locations with no IT staff on site. How do we manage security?
Standardize the network design and device setup at every location, manage endpoints centrally, and monitor alerts remotely. That keeps protection consistent without depending on store or restaurant staff.
Talk to a security practitioner
Tell us what is driving the need: an audit, a client questionnaire, a contract clause or an insurance renewal. We'll recommend a scoped next step with a fixed quote.