{"id":32290,"date":"2018-06-28T06:00:39","date_gmt":"2018-06-28T13:00:39","guid":{"rendered":"https:\/\/oroinc.com\/b2b-ecommerce\/?p=32290"},"modified":"2018-06-27T10:56:14","modified_gmt":"2018-06-27T17:56:14","slug":"pci-dss-is-changing-soon-how-does-this-affect-you","status":"publish","type":"post","link":"https:\/\/oroinc.com\/b2b-ecommerce\/blog\/pci-dss-is-changing-soon-how-does-this-affect-you\/","title":{"rendered":"PCI DSS Is Changing Soon: How Does This Affect You?"},"content":{"rendered":"

Every company that accepts credit card payments on their website must comply with the <\/span>Payment Card Industry Data Security Standard<\/span><\/a> (PCI DSS). Conformity with PCI DSS guarantees the secure processing of online payments and cardholder information handling as well as serves as a reliable trustmark for customers sharing card data on a website order page. (Need a PCI DSS refresher? Check out <\/span>PCI Compliance: What Every eCommerce Business Needs to Know <\/span><\/a>to learn more about PCI requirements and how Oro can help you comply). \u00a0<\/span><\/p>\n

According to the recently updated PCI DSS regulations, all businesses accepting credit card payments online must discontinue the support for SSL\/Early TLS cryptographic protocols and migrate to up-to-date TLS versions by June 30. Here\u2019s how this change may affect your B2B eCommerce business.<\/span><\/p>\n

How PCI DSS Requirements are Changing<\/span><\/h2>\n

As you probably know, the payment card industry has been using SSL (Secure Socket Layer) and Transport Layer Security (TLS) cryptographic protocols as secure forms of encryption. These protocols encrypted the payment and customer data exchanged between the server and browser to preserve information privacy and security. Hackers have learned to breach these controls, so SSL and early versions of TLS (below v.1.1) are no longer secure as they fail to ensure the highest attainable level of protection as required. <\/span><\/p>\n

In order to stay PCI DSS compliant, businesses must migrate to the secure version of TLS protocol. <\/span>The recommended TLS version is now<\/span><\/a> v.1.2 or higher.<\/span><\/p>\n

As a certified and PCI DSS-compliant solutions provider that maintains the highest security standards, Oro uses only TLS encryption protocols<\/i><\/b>. <\/span><\/i><\/p>\n

The steps B2B eCommerce businesses must take to comply with the new PCI DSS requirements and safeguard customer payment data depend on the application deployment method they use. <\/span><\/p>\n

OroCloud User Compliance is Automatic <\/span><\/h2>\n

Because Oro is responsible for PCI compliance on our cloud infrastructure, we\u2019ve already taken care of all upgrades and updates. There\u2019s nothing you need to do on the client side. It\u2019s just another benefit for customers with a cloud-hosted OroCommerce solution.<\/span><\/p>\n

Actions On-Premise Users Should Take<\/span><\/h2>\n

Things look a bit different if you implement OroCommerce on-premise. There are a few changes you must make to set up your servers for compliance.<\/span><\/p>\n

We suggest the following steps to comply with the new PCI DSS requirements:<\/span><\/p>\n