No, You Probably Don't Need 90 Days of Video Surveillance Footage for PCI Compliance

Recently, a competitor started claiming that "PCI compliance requires 90 days of Security Camera Footage." This statement is highly misleading. If you plan on manufacturing credit cards, this is true, but not to accept credit cards.

surveillance industry shortchange

What's the claim?

There's a security camera company that has been claiming that PCI compliance requires having 90 days of security camera footage.

This is an incredibly mislead half-truth, so let's unpack this claim.

Who is Making the Claim

This claim is part of a section of their sales pitch which, depending on the salesman, implies or directly states, that only their equipment is compliant. This is absolutely not the case. Additionally, this company has made several claims that are part of this series and directly markets towards enterprise, corporate, and government focused clients.

Conflating DIfferent PCI Requirements

Herein lies the issue. There's two different PCI compliance requirements.

Understanding PCI DSS Requirements

Most people know of PCI compliance as the that process that they have to jump through in order to accept credit or debit cards. Colloquially, we all call that process "getting PCI compliant," but the reality is that PCI calls that "PCI DSS" Compliance. PCI DSS, here stands for "Payment Card Industry Data Security Standard.". PCI DSS has no specific security camera requirements for accepting credit cards, but has some physical security requirements, which imply that you should probably have cameras, locks, access control or security cameras, depending on your situation. It has absolutely no requirements for footage retention.

Understanding PCI PED Requirements

The problem is that there's another "PCI compliance" - PCI PED, which stands for "Payment Card Industry (PCI) Card Production Security Requirements." PCI PED does require 90 day retention of video footage for credit card production facilities.

Misinformation Harms the Industry by Creating Mistrust

Although a credit card issuing company like VISA may call the process of getting PCI PED accreditation "PCI compliance," that isn't what most people think of by the term.

Telling a customer half-truths isn't the way to earn customer trust and using misinformation to create fear of non-compliance is a bad sales practice.

Here's the Truth, If You Accept Credit Cards, You Should Get Security Cameras, but You Are Not Required To

A cashier handling money should always be recorded. They could get robbed. They could put money in their pocket. They could accidentally mischarge the customer. A customer could assault them. They could assault a customer. A customer could assault another customer in line. There's tons of reasons to get cameras to watch any place where employees and customers interact, especially where money is exchanged.

Documentation and Proof

Relevant sections, analysis, link to entire documentation, for PCI DSS Compliance

PCI DSS Quick Reference Guide Understanding the Payment Card Industry Data Security Standard version 3.2.1

Requirement 9: Restrict physical access to cardholder data

Any physical access to data or systems that house cardholder data provides the opportunity for persons to access and/or remove devices, data, systems or hardcopies, and should be appropriately restricted. “Onsite personnel” are full- and part-time employees, temporary employees, contractors, and consultants who are physically present on the entity’s premises. “Visitors” are vendors and guests that enter the facility for a short duration - usually up to one day. “Media” is all paper and electronic media containing cardholder data.

9.1 Use appropriate facility entry controls to limit and monitor physical access to systems in the cardholder data environment.

9.2 Develop procedures to easily distinguish between onsite personnel and visitors, such as assigning ID badges.

9.3 Control physical access for onsite personnel to the sensitive areas. Access must be authorized and based on individual job function; access must be revoked immediately upon termination, and all physical access mechanisms, such as keys, access cards, etc. returned or disabled.

Clearly, there's no explicit camera requirement here, but cameras are a good way to remaining in compliance with requirement 9.2. It's hard to know if you had a physical security breach if you don't have any video evidence.

Relevant sections, link to entire documentation, for PCI PED Compliance

Payment Card Industry (PCI) Card Production Security Requirements

3.4.5.2 Monitor, Camera, and Digital Recorder Requirements

a) Each monitor, camera, and digital recorder must function properly and produce clear images on the monitors without being out-of-focus, blurred, washed out, or excessively darkened. The equipment must record at a minimum of four frames per second.

CCTV cameras must record all activity, including recording events during dark periods through the use of infrared CCTV cameras or automatic activation of floodlights in case of any detected activity. This recording may be via motion activated. The recording must continue for at least a minute after the last pixel of activity subsides.

c) CCTV monitors and recorders must be located in an area that is restricted from unauthorized personnel.

d) CCTV cameras must be connected at all times to:

o Monitors located in the control room

o An alarm system that will generate an alarm if the CCTV is disrupted

o An active image-recording device

Q30 March (update) 2015

Q. For purposes of this requirement, can motion activation recording be used, such that if there is not any activity and associated motion, there is not any need to record? If motion activation is allowed, how long past cessation of motion must be recorded?

A. This requirement is under revision. The new text will state: CCTV cameras must record all activity, including recording events during dark periods through the use of infrared CCTV cameras or automatic activation of floodlights in case of any detected activity. This recording may be motion activated. The recording must continue for at least ten seconds after the last motion has been detected. The recording must capture any motion at least 10 seconds before and after the detected motion.


  1. The 1080P Admiral Series - 8 Channel HD Customizable Security Camera System



    8 Camera 1080P Admiral Series

    From: $1,199.00


    Cameras


    2MP @ 30 FPS: 1920 x 1080

    85° or 110° options
    IP67 Weatherproof
    Infrared night vision up to 100 FT
    -31°F to 140 °F temp rated


    Processing Power and Compression: Not All 1080P Cameras are Created Equal


    Software


    VCA: Motion Detection, Line Crossing, Face Detection, Intrusion Detection, People Counting, Vandalism Detection
    Video Content Analytics (VCA) Search
    VCA Event based Email Alerts
    Remote Footage Download
    1 Click Firmware Update

    Learn when you would use VCA


    Remote Viewing


    Smartphone Apps
    Tablet Apps
    Windows Apps
    Mac Viewing Apps
    Internet Explorer Viewing

    How Patent Wars have changed Browser Support


    Hardware


    Cat5e (RJ45) Ethernet to Network
    Standard 3-Prong Wall Plug
    SCWEasyConnect 2.0 ports on back for Plug and play 2018 SCW camera auto-configuration up to 750 ft away
    VGA Monitor Out
    4K HDMI Out for TVs/Monitors
    Footage Download via USB

    Learn about automatic backup footage options



  2. The 4K Fixed Admiral Series - 8 Channel HD Customizable Security Camera System



    8 Camera 4K Admiral Series

    From: $1,999.00


    Cameras


    4K (8MP) UHD @ 15 FPS: 3840 x 2160

    92° or 118° options
    IP67 Weatherproof
    Infrared night vision up to 100 FT
    -31°F to 140 °F temp rated

    4MP vs 4K.


    Software


    VCA: Motion Detection, Line Crossing, Face Detection, Intrusion Detection, People Counting, Vandalism Detection
    Video Content Analytics (VCA) Search
    VCA Event based Email Alerts
    Remote Footage Download
    1 Click Firmware Update

    Learn when you would use VCA


    Remote Viewing


    Smartphone Apps
    Tablet Apps
    Windows Apps
    Mac Viewing Apps
    Internet Explorer Viewing

    How Patent Wars have changed Browser Support


    Hardware


    Cat5e (RJ45) Ethernet to Network
    Standard 3-Prong Wall Plug
    SCWEasyConnect 2.0 ports on back for Plug and play 2018 SCW camera auto-configuration up to 750 ft away
    VGA Monitor Out
    4K HDMI Out for TVs/Monitors
    Footage Download via USB

    Learn about automatic backup footage options



  3. The 1080P Admiral Series - 16 Channel HD Customizable Security Camera System



    16 Camera 1080P Admiral Series

    From: $2,199.00


    Cameras


    2MP @ 30 FPS: 1920 x 1080

    85° or 110° options
    IP67 Weatherproof
    Infrared night vision up to 100 FT
    -31°F to 140 °F temp rated


    Processing Power and Compression: Not All 1080P Cameras are Created Equal


    Software


    VCA: Motion Detection, Line Crossing, Face Detection, Intrusion Detection, People Counting, Vandalism Detection
    Video Content Analytics (VCA) Search
    VCA Event based Email Alerts
    Remote Footage Download
    1 Click Firmware Update

    Learn when you would use VCA


    Remote Viewing


    Smartphone Apps
    Tablet Apps
    Windows Apps
    Mac Viewing Apps
    Internet Explorer Viewing

    How Patent Wars have changed Browser Support


    Hardware


    Cat5e (RJ45) Ethernet to Network
    Standard 3-Prong Wall Plug
    SCWEasyConnect 2.0 ports on back for Plug and play 2018 SCW camera auto-configuration up to 750 ft away
    VGA Monitor Out
    4K HDMI Out for TVs/Monitors
    Footage Download via USB

    Learn about automatic backup footage options



  4. The 4K Motorized Admiral Series - 16 Channel HD Customizable Security Camera System




    Cameras


    4K (8MP) UHD @ 30 FPS: 3840 x 2160

    Motorized Varifocal: 2.8 - 12mm
    91° - 27° of coverage
    IP67 Weatherproof
    Infrared night vision up to 325 or 100 FT
    P-Iris Lens or IK10 impact rating
    Extreme Cold Temperature rated from -40°F to 140 °F
    True Wide Dynamic Range (120dB)



    4MP vs 4K.


    Software


    VCA: Motion Detection, Line Crossing, Face Detection, Intrusion Detection, People Counting, Vandalism Detection
    Video Content Analytics (VCA) Search
    VCA Event based Email Alerts
    Remote Footage Download
    1 Click Firmware Update

    Learn when you would use VCA


    Remote Viewing


    Smartphone Apps
    Tablet Apps
    Windows Apps
    Mac Viewing Apps
    Internet Explorer Viewing

    How Patent Wars have changed Browser Support


    Hardware


    Cat5e (RJ45) Ethernet to Network
    Standard 3-Prong Wall Plug
    SCWEasyConnect 2.0 ports on back for Plug and play 2018 SCW camera auto-configuration up to 750 ft away
    VGA Monitor Out
    4K HDMI Out for TVs/Monitors
    Footage Download via USB

    Learn about automatic backup footage options



  5. The 1080P Imperial Series - 64 Channel HD Customizable Security Camera System




    Cameras


    2MP @ 30 FPS: 1920 x 1080

    85° or 110° options
    IP67 Weatherproof
    Infrared night vision up to 100 FT
    -31°F to 140 °F temp rated


    Processing Power and Compression: Not All 1080P Cameras are Created Equal


    Software


    VCA: Motion Detection, Line Crossing, Face Detection, Intrusion Detection, People Counting, Vandalism Detection
    Video Content Analytics (VCA) Search
    VCA Event based Email Alerts
    Remote Footage Download
    1 Click Firmware Update

    Learn when you would use VCA


    Remote Viewing


    Smartphone Apps
    Tablet Apps
    Windows Apps
    Mac Viewing Apps
    Internet Explorer Viewing

    How Patent Wars have changed Browser Support


    Hardware


    Cat5e (RJ45) Ethernet to Network
    Standard 3-Prong Wall Plug
    POE Switches for flexibility in cable runs
    VGA Monitor Out
    4K HDMI Out for TVs/Monitors
    Footage Download via USB

    Learn about automatic backup footage options



  6. The 4K Imperial Series - 100 Channel HD Customizable Security Camera System



    100 Camera 4K Imperial Series

    From: $35,576.99


    Cameras


    4K (8MP) UHD @ 15 FPS: 3840 x 2160

    92° or 118° options
    IP67 Weatherproof
    Infrared night vision up to 100 FT
    -31°F to 140 °F temp rated

    4MP vs 4K.


    Software


    VCA: Motion Detection, Line Crossing, Face Detection, Intrusion Detection, People Counting, Vandalism Detection
    Video Content Analytics (VCA) Search
    VCA Event based Email Alerts
    Remote Footage Download
    1 Click Firmware Update

    Learn when you would use VCA


    Remote Viewing


    Smartphone Apps
    Tablet Apps
    Windows Apps
    Mac Viewing Apps
    Internet Explorer Viewing

    How Patent Wars have changed Browser Support


    Hardware


    Cat5e (RJ45) Ethernet to Network
    Standard 3-Prong Wall Plug
    POE Switches for flexibility in cable runs
    VGA Monitor Out
    4K HDMI Out for TVs/Monitors
    Footage Download via USB

    Learn about automatic backup footage options