Overview
Payment Card Industry Data Security Standard (PCI DSS) compliance is required for any business that stores, processes, or transmits payment card data. Developed by the major credit card companies, the PCI DSS defines measures for ensuring data protection and consistent security processes and procedures around online financial transactions. As formulated by the PCI Security Standards Council, the mandate of PCI DSS compliance includes:
- Developing and maintaining a security policy that covers all aspects of the business
- Installing firewalls to protect data
- Encrypting cardholder data that is transmitted over public networks
- Using antivirus software and updating it regularly
- Establishing strong passwords and other cybersecurity protocols
- Enforcing rigid access controls and monitoring access to account data
For large merchants and service providers that process high volumes of online financial transactions, PCI DSS compliance is enforced by annual validations performed by an independent Qualified Security Assessor (QSA).
Resources
Akamai Certification
Akamai’s Attestation of Compliance (AoC) serves as evidence for our customers that our in-scope services are compliant with the PCI DSS v4.0 security standard.
In connection with our PCI DSS compliance, Akamai performs semiannual third-party external penetration tests of the systems included in the scope of our assessment. Results of these penetration tests, and compliance documentation and/or certification, are available for customers under nondisclosure agreement (NDA) in the Download Center section of the Akamai Control Center customer portal.
Downloads / Links
Applicable Akamai Services
- Secure CDN with Enhanced TLS (the “Secure CDN”)
- Content Delivery products such as Ion, Dynamic Site Accelerator, API Acceleration, and Adaptive Media Delivery, when running on the Secure CDN
- EdgeWorkers, when running on the Secure CDN
- Cloudlets
- mPulse digital performance management service
- API Gateway
- App and API security products such as App & API Protector (including the Malware Protection add-on), Account Protector, Kona Site Defender, Cloudlets, and Bot Manager (Standard and Premier), when running on the Secure CDN
- App & API Protector Hybrid
- API Security (formerly Noname Security)
- API Security (formerly Neosec)
- Client-Side Protection & Compliance
- Audience Hijacking Protector
- Secure Internet Access Enterprise (f/k/a Enterprise Threat Protector)
- Akamai MFA
Q&A
Is Akamai PCI DSS Certified?
Yes, Akamai is certified as a PCI DSS Level 1 Service Provider, the highest level of assessment available. The PCI DSS Attestation of Compliance and Responsibility Matrix are publicly available at the links above.
If my website is using Akamai, how can I be sure that it is PCI DSS compliant?
Customers are responsible for their own PCI DSS certification and should engage a Qualified Security Assessor (QSA) to validate their controls and obtain certification. Customers and their QSAs may rely on Akamai’s Attestation of Compliance for the portion of their cardholder data environment to use Akamai’s PCI DSS compliant services. Akamai’s PCI DSS Responsibility Matrices (see links above) spell out the responsibilities of Akamai and our customers with respect to each of the PCI DSS requirements. Our PCI DSS Customer Configuration Guide, which provides more details, is available in the Download Center section of the Akamai Control Center customer portal, or your account team can provide it to you.
Can I review an executive summary of Akamai’s quarterly Approved Scanning Vendor (ASV) vulnerability scans and external penetration tests?
Yes. Your account team may provide this information subject to standard nondisclosure agreement (NDA). It is also available in the Download Center section of the Akamai Control Center customer portal.