Learn about QuickBooks PCI Compliance

The PCI DSS is a list of practices merchants must follow to accept payment cards. This includes how to securely handle, process, and store sensitive payment card data. The PCI standard covers the following 12 requirements

Protect your system with firewalls

• Install a hardware and software firewall.
• Configure firewalls for your environment.
• Have strict firewall rules.

Use adequate configuration standards

• Change default passwords.
• Harden your systems.
• Implement system configuration management.

Protect stored data

• Find where card data is.
• Craft your card flow diagram.
• Encrypt stored card data.

Secure data over open and public networks

• Know where they send and receive data.
• Encrypt all transmitted cardholder data.
• Stop using SSl and early TLS.

Protect systems with antivirus

• Create a vulnerability management plan.
• Regularly update antivirus.
• Maintain an up-to-date malware program.

Update your systems

• Consistently update your systems.
• Apply all critical/high patches to systems and software.
• Establish secure software development processes.

Restrict access

• Restrict access to cardholder data.
• Document who has access to the card data environment.
• Establish a role-based access control system.

Use unique ID credentials

• Use unique ID credentials for every employee.
• Disable/delete inactive accounts.
• Configure multi-factor authentication.

Maintain physical security

• Control physical access at your workplace.
• Keep track of POS terminals.
• Train your employees often.

Implement logging and log monitoring

• Implement logging and alerting.
• Establish log management.
• Create log management system rules.

Conduct vulnerability scans and penetration testing

• Know your environment.
• Run vulnerability scans quarterly.
• Conduct a penetration test

Start documentation and risk assessments

• Document policies and procedures for everything.
• Implement a risk assessment process.
• Create an incident response plan. (IRP)

The way you process credit cards determines what requirements you need to follow. Find more details in the Self-Assessment Questionnaires (SAQ). Here are the SAQ types:

All merchants that accept credit or debit cards.

How you handle and process payment cards and the number of transactions you process annually defines your validation requirements. All merchants are required to complete a Self-Assessment Questionnaire (SAQ). The required SAQ depends on how you store, handle, and process card data. Some additional requirements may include:

External vulnerability scanning
Internal vulnerability scanning
Penetration testing
Security policy implementation

Yes. Intuit and our products are on the PCI Security Standards Council website as compliant. While QuickBooks applications are secure, other applications on your local computer/network can compromise the security of your environment. Use of QuickBooks Payments services doesn’t mean you’re already PCI compliant. Just that pieces of the transaction processing chain are compliant.

Intuit has partnered with SecurityMetrics to streamline the PCI compliance validation process. SecurityMetrics charges an annual fee to merchants. If you choose to use SecurityMetrics, you need to create an account with SecurityMetrics. After you complete SecurityMetrics’ FastPass, you can purchase the PCI package that best suits your needs. From there, complete an SAQ, then set up your scans.

Data security is more important now than ever as hackers become more prevalent. PCI compliance increases your security against attacks .If a breach occurs, you may

• Be liable for the fines listed below.
• Need to spend on card re-issuance, acquirer fees, legal fees, and more.

Becoming PCI compliant is an ongoing process. As a merchant, you’re required to validate your PCI compliance yearly. This includes re-submitting the SAQ and passing the required scans. 

Although validation is only an annual requirement, you’re required and expected to follow the PCI requirements all the time. This includes watching the environment to identify any suspicious activity. 

Learn about PCI compliance and your responsibilities:

• PCI Security Standards
• PCI Educational Resources
• SecurityMetrics PCI Guide

ProAdvisors are subject to the same criteria as everyone else.

1. Sign in to the Merchant Service Center.
2. Go to Activities & Reports, then Statements.

Intuit's Terms of Service is your written agreement. You can provide it as part of the PCI questionnaire.