Any business that stores, processes or transmits payment-card data lives with the Payment Card Industry Data Security Standard (PCI DSS). Moving that data into the cloud raises an obvious question: who is responsible for compliance - you, or your provider? The honest answer is both, and understanding the split is the key to doing it well.
Shared responsibility, clearly drawn
In a cloud environment, the provider is responsible for the compliance of the underlying platform - the hardware, the network and the controls around them - while the customer remains responsible for how they configure and use it. Problems arise when that line is fuzzy. The value of a purpose-built PCI-DSS-ready cloud is that the provider has already certified everything up to the line, leaving the customer a far smaller, clearly defined scope to manage.
What “PCI DSS ready” should mean
It should mean a packaged environment of PCI-DSS-compliant hardware, software and network services, independently audited against the current standard. When KVH’s PCI DSS Ready Cloud was certified compliant with PCI DSS v3.0 - as announced in our press release - the point was to give financial and e-commerce customers a faster, lower-risk path to a compliant environment, rather than building one from scratch.
Compliance as part of a wider platform
PCI DSS rarely stands alone. For trading firms and payment businesses it sits alongside low-latency connectivity, proximity hosting and resilient data centers - the same ingredients that make up KVH’s Capital Markets Solutions. Treating compliance as one requirement within an integrated platform, rather than a bolt-on, is what keeps it manageable as your business grows.