Visa rolls out new payment application security mandates

At the same time, Visa has also been circulating a frequently updated list of vulnerable payment applications with instructions to card-issuing banks to get merchants to stop using such software.

Tuesday's announcement formalizes these efforts into a set of standards that companies need to implement with a specific time frame.

The first phase of Visa's payment application security mandates goes into effect on Jan. 1, 2008. After that date, the so-called acquiring banks that authorize companies to accept payment card transactions will be prohibited from authorizing new merchants that use payment applications known to be vulnerable. According to an Oct. 23 Visa bulletin, the goal in the first phase is to deter software vendors from introducing new vulnerable applications into the payment system.

The next two phases, which go into effect on July 1 and Oct. 1, 2008, respectively, are designed to get payment processors, agents and merchants to start using software that is compliant with the new application security standards.

Starting on Oct. 1, 2009, all merchants will be required to start terminating the use of any noncompliant payment applications that they might still have in their environments. The fifth phase, beginning July 1, 2010, mandates the use of only those payment applications that support the new standards, according to Visa.

The application rules complement a separate set of PCI standards that are already in place for all entities handling payment cards. Under PCI, merchants are required to implement a set of 12 security controls such as encryption, transaction logging and access management for protecting cardholder data.

Though the requirements went into effect more than two years ago, a large number of big retailers are still noncompliant because of a variety of issues that include legacy system challenges, rules interpretation issues and continuously evolving guidelines.

Read more about Security in Computerworld's Security Topic Center.