Adopted more than a decade ago by payment system industry leaders, including Visa, MasterCard, and American Express, PCI DSS guarantees that a service or system is securely protected. Obtaining such certification is mandatory for companies making money transfers and online payments using bank cards, including not only banks and payment systems, but also retail chains and telecom carriers selling goods and services online. If an information system using cardholder details is hosted on an outsourced site, then this site must also be checked for PCI DSS compliance.

Finance, e-commerce, telecom, and other companies, which accept bank card payments from online clients and are served by CROC, can now be sure that they are moving their services to a cloud platform that meets global security standards and offers a double guarantee of fault tolerance.

It took more than a year to bring the entire cloud platform, including data center, virtual infrastructure, and operational procedures, in line with PCI DSS, with all cloud components, especially the network, being checked and improved.

The certification procedure was performed by Digital Compliance, a Digital Security subsidiary which provides information security compliance services to financial institutions and payment systems and issues a certificate of compliance that guarantees secure storage and processing of customer payment details. In addition, CROC’s customers can now have their cloud services verified for compliance with all PCI DSS requirements in a faster and easier manner.

CROC’s new certificate can also benefit customers that do not carry out payment card processing in CROC’s cloud.

Since PCI DSS requirements cover virtually all security aspects, this certificate is sufficient to convince a customer’s CISO regarding the security of CROC’s cloud and facilitate migration decision-making.

«CROC’s cloud is our proprietary product and unparalleled in Russia. The platform can be easily adjusted to the business tasks of large customers that move their core systems to the cloud. Maximum data security, the highest possible level of performance, fault tolerance (as cloud is based on geographically distributed sites), rich cloud service portfolio, a customer-focused approach, and skilled 24/7 support represent key cloud-specific features and our competitive advantages,» said Maxim Berezin, Cloud Service Development Director, CROC.

As one of the PCI DSS certification prerequisites, Digital Security performed penetration testing involving a hacker attack simulation. CROC’s cloud successfully passed this test, proving its resilience and compliance with strict information security requirements.

«Although we have been performing PCI DSS compliance audits for approximately nine years now, this was the first cloud platform of such level and scale that we have seen. In addition, CROC employees demonstrated their advanced skills in cloud support, security, and secure software development,» said Andrey Gaiko, QSA Auditor and Deputy Director, Digital Compliance.