PCI Quick Reference Guide

PCIQuickReferenceGuide
UnderstandingthePaymentCardIndustry
DataSecurityStandardversion1.2
Formerchantsandorganizationsthatstore,processortransmitcardholderdata
Contents

Copyright2008PCISecurityStandardsCouncil,LLC.AllRightsReserved.
ThisQuickReferenceGuidetothePCIDataSecurityStandardisprovidedbythePCISecurity
StandardsCounciltoinformandeducatemerchantsandotherorganizationsthatprocess,storeor
transmitcardholderdata.FormoreinformationaboutthePCISSCandthestandardswemanage,
pleasevisitwww.pcisecuritystandards.org.
Theintentofthisdocumentistoprovidesupplementalinformation,whichdoesnotreplaceor
supersedePCISecurityStandardsCouncilstandardsortheirsupportingdocuments.Fulldetailscan
befoundonourWebsite.
03/09

3
ThisGuideprovidessupplementalinformationthatdoesnotreplaceorsupersedePCIDSSversion1.2documents.
Contents
Introduction:ProtectingCardholderDatawithPCISecurityStandards...................................4
OverviewofPCIRequirements......................................................................................................................6
PCIDataSecurityStandard(PCIDSS)....................................................................................................8
PaymentApplicationDataSecurityStandard(PADSS)..................................................................10
PINTransactionSecurityRequirements(PTS)....................................................................................10
SecurityControlsandProcessesforPCIDSSRequirements.............................................................11
BuildandMaintainaSecureNetwork...................................................................................................12
ProtectCardholderData............................................................................................................................14
MaintainaVulnerabilityManagementProgram...............................................................................16
ImplementStrongAccessControlMeasures.....................................................................................18
RegularlyMonitorandTestNetworks...................................................................................................21
MaintainanInformationSecurityPolicy..............................................................................................23
CompensatingControlsforPCISecurity..............................................................................................24
HowtoComplywithPCIDSS............................................................................................................................25
ChoosingaQualifiedSecurityAssessor(QSA)...................................................................................26
ChoosinganApprovedScanningVendor(ASV)...............................................................................27
UsingtheSelf-AssessmentQuestionnaire(SAQ)..............................................................................28
Reporting.......................................................................................................................................................29
WebResources.......................................................................................................................................................30
AboutthePCISecurityStandardsCouncil...............................................................................................31
Introduction

4
Introduction:ProtectingCardholderDatawith
PCISecurityStandards
ThetwentiethcenturyU.S.criminalWillieSuttonwassaidtorobbanksbecause“that’swherethe
moneyis.”Thesamemotivationinourdigitalagemakesmerchantsthenewtargetforfinancial
fraud.Occasionallylaxsecuritybysomemerchantsenablescriminalstoeasilystealandusepersonal
consumerfinancialinformationfrompaymentcardtransactionsandprocessingsystems.
It’saseriousproblem–morethan234millionrecordswithsensitiveinformationhavebeenbreached
sinceJanuary2005,accordingtoPrivacyRightsClearinghouse.org.Asamerchant,youareatthe
centerofpaymentcardtransactionssoitisimperativethatyouusestandardsecurityproceduresand
technologiestothwarttheftofcardholderdata.
Merchant-basedvulnerabilitiesmayappearalmostanywhereinthecard-processingecosystem
includingpoint-of-saledevices;personalcomputersorservers;wirelesshotspotsorWebshopping
applications;inpaper-basedstoragesystems;andunsecuredtransmissionofcardholderdatato
serviceproviders.Vulnerabilitiesmayevenextendtosystemsoperatedbyserviceprovidersand
acquirers,whicharethefinancialinstitutionsthatinitiateandmaintaintherelationshipswith
merchantsthatacceptpaymentcards(seediagramonpage5).
CompliancewiththePaymentCardIndustry(PCI)DataSecurityStandard(DSS)helpstoalleviate
thesevulnerabilitiesandprotectcardholderdata.
RISKYBEHAVIOR
AsurveyofbusinessesintheU.S.
andEuroperevealsactivitiesthat
mayputcardholderdataatrisk.
81%storepaymentcard
numbers
73%storepaymentcard
expirationdates
71%storepaymentcard
verificationcodes
57%storecustomerdatafrom
thepaymentcardmagneticstripe
16%storeotherpersonaldata
Source:ForresterConsulting:TheState
ofPCICompliance(commissionedby
RSA/EMC)

5
TheintentofthisPCIQuickReferenceGuideistohelpyouunderstandthePCIDSSandtoapplyitto
yourpaymentcardtransactionenvironment.
TherearethreeongoingstepsforadheringtothePCIDSS:Assess—identifyingcardholder
data,takinganinventoryofyourITassetsandbusinessprocessesforpaymentcardprocessing,
andanalyzingthemforvulnerabilitiesthatcouldexposecardholderdata.Remediate—fixing
vulnerabilitiesandnotstoringcardholderdataunlessyouneedit.Report—compilingand
submittingrequiredremediationvalidationrecords(ifapplicable),andsubmittingcompliancereports
totheacquiringbankandcardbrandsyoudobusinesswith.
PCIDSSfollowscommonsensestepsthatmirrorbestsecuritypractices.TheDSSgloballyappliesto
allentitiesthatstore,processortransmitcardholderdata.PCIDSSandrelatedsecuritystandards
areadministeredbythePCISecurityStandardsCouncil,whichwasfoundedbyAmericanExpress,
DiscoverFinancialServices,JCBInternational,MasterCardWorldwideandVisaInc.Participating
organizationsincludemerchants,paymentcardissuingbanks,processors,developersandother
vendors.
PCICOMPLIANCEISA
CONTINUOUSPROCESS
ASSESS
REMEDIATE
REPORT
AA
DIATEDIATE
POSMerchantAcquirerServiceProvider
INTERNET
PUBLICNETWORKS
WIRELESS
INTERNET
PUBLICNETWORKS
WIRELESS
INTERNET
PUBLICNETWORKS
WIRELESS
OverviewofPCI
Requirements

6
OverviewofPCIRequirements
PCIsecuritystandardsaretechnicalandoperationalrequirementssetbythePCISecurityStandards
Council(PCISSC)toprotectcardholderdata.Thestandardsapplytoallorganizationsthatstore,
processortransmitcardholderdata–withguidanceforsoftwaredevelopersandmanufacturers
ofapplicationsanddevicesusedinthosetransactions.TheCouncilisresponsibleformanaging
thesecuritystandards,whilecompliancewiththePCIsetofstandardsisenforcedbythefounding
membersoftheCouncil,AmericanExpress,DiscoverFinancialServices,JCBInternational,MasterCard
WorldwideandVisaInc.
PAYMENTCARDINDUSTRYSECURITYSTANDARDS
ProtectionofCardholderPaymentData
MANUFACTURERS
SOFTWARE
DEVELOPERS
MERCHANTS&
PROCESSORS
PCISECURITY
STANDARDS
&COMPLIANCE
PCIPTS
PaymentApplication
Vendors
DataSecurity
Standard
PINTransaction
Security
PCIPA-DSSPCIDSS
Ecosystemofpaymentdevices,applications,infrastructureandusers

7
PCISecurityStandardsInclude:
PCIDataSecurityStandard(DSS)
ThePCIDSSappliestoallentitiesthatstore,process,and/ortransmitcardholderdata.Itcovers
technicalandoperationalsystemcomponentsincludedinorconnectedtocardholderdata.Ifyouare
amerchantwhoacceptsorprocessespaymentcards,youmustcomplywiththePCIDSS.
PINTransaction(PTS)SecurityRequirements
PCIPTS(formerlyPCIPED)isasetofsecurityrequirementsfocusedoncharacteristicsand
managementofdevicesusedintheprotectionofcardholderPINsandotherpaymentprocessing
relatedactivities.Therequirementsareformanufacturerstofollowinthedesign,manufactureand
transportofadevicetotheentitythatimplementsit.Financialinstitutions,processors,merchantsand
serviceprovidersshouldonlyusedevicesorcomponentsthataretestedandapprovedbythePCI SSC
(www.pcisecuritystandards.org/security_standards/ped/pedapprovallist.html).
PaymentApplicationDataSecurityStandard(PA-DSS)
ThePA-DSSisforsoftwaredevelopersandintegratorsofpaymentapplicationsthatstore,process
ortransmitcardholderdataaspartofauthorizationorsettlementwhentheseapplicationsaresold,
distributedorlicensedtothirdparties.Mostcardbrandsencouragemerchantstousepayment
applicationsthataretestedandapprovedbythePCISSC.Validatedapplicationsarelistedat:
www.pcisecuritystandards.org/security_standards/pa_dss.shtml

8
ThePCIDataSecurityStandard
ThePCIDSSversion1.2istheglobaldatasecuritystandardadoptedbythecardbrandsforall
organizationsthatprocess,storeortransmitcardholderdata.Itconsistsofcommonsensestepsthat
mirrorbestsecuritypractices.
GoalsPCIDSSRequirements
BuildandMaintainaSecure
Network
1.Installandmaintainafirewallconfigurationtoprotectcardholder
data
2.Donotusevendor-supplieddefaultsforsystempasswordsand
othersecurityparameters
ProtectCardholderData3.Protectstoredcardholderdata
4.Encrypttransmissionofcardholderdataacrossopen,public
networks
MaintainaVulnerability
ManagementProgram
5.Useandregularlyupdateanti-virussoftwareorprograms
6.Developandmaintainsecuresystemsandapplications
ImplementStrongAccess
ControlMeasures
7.Restrictaccesstocardholderdatabybusinessneed-to-know
8.AssignauniqueIDtoeachpersonwithcomputeraccess
9.Restrictphysicalaccesstocardholderdata
RegularlyMonitorandTest
Networks
10.Trackandmonitorallaccesstonetworkresourcesandcardholder
data
11.Regularlytestsecuritysystemsandprocesses
MaintainanInformation
SecurityPolicy
12.Maintainapolicythataddressesinformationsecurityfor
employeesandcontractors

9
ToolsforAssessingCompliancewithPCIDSS
ThePCISSCsetsthePCIDSSstandard,buteachcardbrandhasitsownprogramforcompliance,
validationlevelsandenforcement.Moreinformationaboutcompliancecanbefoundattheselinks:
•AmericanExpress:•www.americanexpress.com/datasecurity
•DiscoverFinancialServices:•www.discovernetwork.com/fraudsecurity/disc.html
•JCBInternational:•www.jcb-global.com/english/pci/index.html
•MasterCardWorldwide:•www.mastercard.com/sdp
•VisaInc:•www.visa.com/cisp
VisaEurope:•www.visaeurope.com/ais
QualifiedAssessors.TheCouncilmanagesprogramsthatwillhelpfacilitatetheassessmentof
compliancewithPCIDSS:QualifiedSecurityAssessor(QSA)andApprovedScanningVendor(ASV).
QSAsareapprovedbytheCounciltoassesscompliancewiththePCIDSS.ASVsareapprovedbythe
CounciltovalidateadherencetothePCIDSSscanrequirementsbyperformingvulnerabilityscansof
Internet-facingenvironmentsofmerchantsandserviceproviders.Additionaldetailscanbefoundon
ourWebsiteat:www.pcisecuritystandards.org/qsa_asv/find_one.shtml
Self-AssessmentQuestionnaire.The“SAQ”isavalidationtoolfororganizationsthatarenot
requiredtoundergoanon-siteassessmentforPCIDSScompliance.DifferentSAQsarespecifiedfor
variousbusinesssituations;moredetailscanfoundonourWebsiteat:
www.pcisecuritystandards.org/saq/index.shtml.Theorganization’sacquiringfinancialinstitutioncan
alsodetermineifitshouldcompleteaSAQ.

10
PaymentApplicationDataSecurityStandard
ThePA-DSSisastandardfordevelopersofpaymentapplications.Itsgoalistohelpdevelopmentof
securecommercialpaymentapplicationsthatdonotstoreprohibiteddata,andensurethatpayment
applicationssupportcompliancewiththePCIDSS.Merchantsandserviceprovidersshouldensure
thattheyareusingCouncil-approvedpaymentapplications;checkwithyouracquiringfinancial
institutiontounderstandrequirementsandassociatedtimeframesforimplementingapproved
applications.PA-DSShas14requirements:FordetailsandalistofapprovedPaymentApplications,
see:www.pcisecuritystandards.org/security_standards/pa_dss.shtml
PINTransaction(PTS)SecurityRequirements
Theserequirements,referredtoasPCIPTS(formerlyPCIPED),appliestocompanieswhichmake
devicesorcomponentsthatacceptorprocesspersonalidentificationnumbersasapartofaPIN
basedtransactionandforotherpaymentprocessingrelatedactivities.RecognizedPTSlaboratories
validateadherencetothePTSrequirements.Financialinstitutions,processors,merchantsandservice
providersshouldensurethattheyareusingapprovedPTSdevicesorcomponents.Nonfinancial
institutionsshouldcheckwiththeiracquiringfinancialinstitutiontounderstandrequirementsand
associatedtimeframesforcompliance.ThePTSrequirementscoverdevices,includingthephysicaland
logicalsecuritycharacteristicsoftheircomponents,anddevicemanagement.Fordetailsandalistof
approvedPTSdevicesandcomponentssee:
www.pcisecuritystandards.org/security_standards/ped/index.shtml

11
SecurityControls
andProcessesforPCI
DSSRequirements
SecurityControlsandProcessesfor
PCIDSSRequirements
ThegoalofthePCIDataSecurityStandardversion1.2(PCIDSS)istoprotectcardholderdatathat
isprocessed,storedortransmittedbymerchants.Thesecuritycontrolsandprocessesrequiredby
PCIDSSarevitalforprotectingcardholderaccountdata,includingthePAN–theprimaryaccount
numberprintedonthefrontofapaymentcard.Merchantsandanyotherserviceprovidersinvolved
withpaymentcardprocessingmustneverstoresensitiveauthenticationdataafterauthorization.This
includessensitivedatathatisprintedonacard,orstoredonacard’smagneticstripeorchip–and
personalidentificationnumbersenteredbythecardholder.ThischapterpresentstheobjectivesofPCI
DSSandrelated12requirements.
CID
(AmericanExpress)
ExpirationDateMagneticStripe
(dataontracks1&2)
PAN
Chip
(dataonmagnetic
stripeimage)
CAV2/CID/CVC2/CVV2
(Discover,JCB,MasterCard,Visa)
TypesofDataonaPaymentCard

12
BuildandMaintainaSecureNetwork
Inthepast,theftoffinancialrecordsrequiredacriminaltophysicallyenteranorganization’sbusiness
site.Now,manypaymentcardtransactions(suchasdebitintheU.S.and“chipandpin”inEurope)
usePINentrydevicesandcomputersconnectedbynetworks.Byusingnetworksecuritycontrols,
organizationscanpreventcriminalsfromvirtuallyaccessingpaymentsystemnetworksandstealing
cardholderdata.
Requirement1:Installandmaintainafirewallandrouterconfigurationtoprotect
cardholderdata
Firewallsaredevicesthatcontrolcomputertrafficallowedintoandoutofanorganization’snetwork,
andintosensitiveareaswithinitsinternalnetwork.Routersarehardwareorsoftwarethatconnects
twoormorenetworks.
1.1Establishfirewallandrouterconfigurationstandardsthatformalizetestingwhenever
configurationschange;thatidentifyallconnectionstocardholderdata(includingwireless);that
usevarioustechnicalsettingsforeachimplementation;andstipulateareviewofconfiguration
rulesetsatleasteverysixmonths.
1.2Buildafirewallconfigurationthatdeniesalltrafficfrom“untrusted”networksandhosts,except
forprotocolsnecessaryforthecardholderdataenvironment.
1.3ProhibitdirectpublicaccessbetweentheInternetandanysystemcomponentinthecardholder
dataenvironment.
1.4Installpersonalfirewallsoftwareonanymobileand/oremployee-ownedcomputerswithdirect
connectivitytotheInternetthatareusedtoaccesstheorganization’snetwork.
CONTROLSFOR
NETWORKSECURITY
Firewall
Devicethatcontrolsthepassage
oftrafficbetweennetworksand
withinaninternalnetwork
Router
Hardwareorsoftwarethatconnects
trafficbetweentwoormore
networks
Illustration/Photo:WikimediaCommons

13
Requirement2:Donotusevendor-supplieddefaultsforsystempasswordsandother
securityparameters
Theeasiestwayforahackertoaccessyourinternalnetworkistotrydefaultpasswordsorexploits
basedondefaultsystemsoftwaresettingsinyourpaymentcardinfrastructure.Fartoooften,
merchantsdonotchangedefaultpasswordsorsettingsupondeployment.Thisisakintoleavingyour
storephysicallyunlockedwhenyougohomeforthenight.Defaultpasswordsandsettingsformost
networkdevicesarewidelyknown.Thisinformation,combinedwithhackertoolsthatshowwhat
devicesareonyournetworkcanmakeunauthorizedentryasimpletask–ifyouhavefailedtochange
thedefaults.
2.1Alwayschangevendor-supplieddefaultsbeforeinstallingasystemonthenetwork.Thisincludes
wirelessdevicesthatareconnectedtothecardholderdataenvironmentorareusedtotransmit
cardholderdata.
2.2Developconfigurationstandardsforallsystemcomponentsthataddressallknownsecurity
vulnerabilitiesandareconsistentwithindustry-accepteddefinitions.
2.3Encryptallnon-consoleadministrativeaccesssuchasbrowser/Web-basedmanagementtools.
2.4Sharedhostingprovidersmustprotecteachentity’shostedenvironmentandcardholder
data(detailsareinPCIDSSAppendixA:“AdditionalPCIDSSRequirementsforSharedHosting
Providers.”)
TYPICALDEFAULT
PASSWORDSTHATMUST
BECHANGED
[none]
[nameofproduct/vendor]
1234or4321
access
admin
anonymous
database
guest
manager
pass
password
root
sa
secret
sysadmin
user

14
ProtectCardholderData
Cardholderdatareferstoanyinformationprinted,processed,transmittedorstoredinanyformona
paymentcard.Organizationsacceptingpaymentcardsareexpectedtoprotectcardholderdataand
topreventtheirunauthorizeduse–whetherthedataisprintedorstoredlocally,ortransmittedovera
publicnetworktoaremoteserverorserviceprovider.
Requirement3:Protectstoredcardholderdata
Ingeneral,nocardholderdatashouldeverbestoredunlessit’snecessarytomeettheneedsofthe
business.Sensitivedataonthemagneticstripeorchipmustneverbestored.Ifyourorganization
storesPAN,itiscrucialtorenderitunreadable(see3.4,andtablebelowforguidelines).
3.1Limitcardholderdatastorageandretentiontimetothatrequiredforbusiness,legal,and/or
regulatorypurposes,asdocumentedinyourdataretentionpolicy.
3.2Donotstoresensitiveauthenticationdataafterauthorization(evenifitisencrypted).See
guidelinesintablebelow.
3.3MaskPANwhendisplayed;thefirstsixandlastfourdigitsarethemaximumnumberofdigits
youmaydisplay.Notapplicableforauthorizedpeoplewithalegitimatebusinessneedtosee
thefullPAN.Doesnotsupersedestricterrequirementsinplacefordisplaysofcardholderdata
suchasonapoint-of-salereceipt.
3.4RenderPAN,atminimum,unreadableanywhereitisstored–includingonportabledigital
media,backupmedia,inlogs,anddatareceivedfromorstoredbywirelessnetworks.
Technologysolutionsforthisrequirementmayincludestrongone-wayhashfunctions,
truncation,indextokens,securelystoredpads,orstrongcryptography.(SeePCIDSSGlossaryfor
definitionofstrongcryptography.)
ENCRYPTIONPRIMER
Cryptographyusesamathematical
formulatorenderplaintextdata
unreadabletopeoplewithout
specialknowledge(calleda“key”).
Cryptographyisappliedtostored
dataaswellasdatatransmitted
overanetwork.
Encryptionchangesplaintextinto
ciphertext.
Decryptionchangesciphertext
backintoplaintext.
Illustration:WikimediaCommons

15
3.5Protectcryptographickeysusedforencryptionofcardholderdatafromdisclosureandmisuse.
3.6Fullydocumentandimplementallappropriatekeymanagementprocessesandproceduresfor
cryptographickeysusedforencryptionofcardholderdata.
GuidelinesforCardholderDataElements
DataElement
Storage
Permitted
Protection
Required
PCIDSS
Req.3.4
CardholderData
PrimaryAccountNumber(PAN)YesYesYes
CardholderName1YesYes1No
ServiceCode1YesYes1No
ExpirationDate1YesYes1No
Sensitive
Authentication
Data2
FullMagneticStripeData3NoN/AN/A
CAV2/CVC2/CVV2/CIDNoN/AN/A
PIN/PINBlockNoN/AN/A
1ThesedataelementsmustbeprotectedifstoredinconjunctionwiththePAN.ThisprotectionshouldbeperPCIDSS
requirementsforgeneralprotectionofthecardholderdataenvironment.Additionally,otherlegislation(forexample,
relatedtoconsumerpersonaldataprotection,privacy,identitytheft,ordatasecurity)mayrequirespecificprotectionof
thisdata,orproperdisclosureofacompany’spracticesifconsumer-relatedpersonaldataisbeingcollectedduringthe
courseofbusiness.PCIDSS,however,doesnotapplyifPANsarenotstored,processed,ortransmitted.
2Sensitiveauthenticationdatamustnotbestoredafterauthorization(evenifencrypted).
3Fulltrackdatafromthemagneticstripe,magneticstripeimageonthechip,orelsewhere.

16
Requirement4:Encrypttransmissionofcardholderdataacrossopen,publicnetworks
Cybercriminalsmaybeabletointercepttransmissionsofcardholderdataoveropen,publicnetworks
soitisimportanttopreventtheirabilitytoviewthesedata.Encryptionisatechnologyusedtorender
transmitteddataunreadablebyanyunauthorizedperson.
4.1UsestrongcryptographyandsecurityprotocolssuchasSSL/TLSorIPSECtosafeguardsensitive
cardholderdataduringtransmissionoveropen,publicnetworks(e.g.Internet,wireless
technologies,globalsystemsforcommunications[GSM],generalpacketradiosystems[GPRS]).
Ensurewirelessnetworkstransmittingcardholderdataorconnectedtothecardholderdata
environmentuseindustrybestpractices(e.g.,IEEE802.11ix)toimplementstrongencryption
forauthenticationandtransmission.Fornewwirelessimplementations,itisprohibitedto
implementWEPafterMarch31,2009.Forcurrentimplementations,itisprohibitedtouseWEP
afterJune30,2010.
4.2NeversendunencryptedPANsbyendusermessagingtechnologies.
MaintainaVulnerabilityManagementProgram
Vulnerabilitymanagementistheprocessofsystematicallyandcontinuouslyfindingweaknessesinan
organization’spaymentcardinfrastructuresystem.Thisincludessecurityprocedures,systemdesign,
implementation,orinternalcontrolsthatcouldbeexploitedtoviolatesystemsecuritypolicy.
Requirement5:Useandregularlyupdateanti-virussoftwareorprograms
Manyvulnerabilitiesandmaliciousvirusesenterthenetworkviaemployees’e-mailandotheronline
activities.Anti-virussoftwaremustbeusedonallsystemsaffectedbymalwaretoprotectsystems
fromcurrentandevolvingmalicioussoftwarethreats.
VULNERABILITY
MANAGEMENT
Createpolicygoverningsecurity
controlsaccordingtoindustry
standardbestpractices(e.g.,IEEE
802.11ix)
Regularlyscansystemsfor
vulnerabilities
Createremediationschedule
basedonriskandpriority
Pre-testanddeploypatches
Rescantoverifycompliance
Updatesecuritysoftwarewith
themostcurrentsignaturesand
technology
Useonlysoftwareorsystems
thatweresecurelydevelopedby
industrystandardbestpractices

17
5.1Deployanti-virussoftwareonallsystemsaffectedbymalicioussoftware(particularlypersonal
computersandservers).
5.2Ensurethatallanti-virusmechanismsarecurrent,activelyrunning,andcapableofgenerating
auditlogs.
Requirement6:Developandmaintainsecuresystemsandapplications
SecurityvulnerabilitiesinsystemsandapplicationsmayallowcriminalstoaccessPANandother
cardholderdata.Manyofthesevulnerabilitiesareeliminatedbyinstallingvendor-providedsecurity
patches,whichperformaquick-repairjobforaspecificpieceofprogrammingcode.Allcritical
systemsmusthavethemostrecentlyreleasedsoftwarepatchestopreventexploitation.Organizations
shouldapplypatchestoless-criticalsystemsassoonaspossible,basedonarisk-basedvulnerability
managementprogram.Securecodingpracticesfordevelopingpaymentsapplications,change
controlproceduresandothersecuresoftwaredevelopmentpracticesshouldalwaysbefollowed.
6.1Ensurethatallsystemcomponentsandsoftwarehavethelatestvendor-suppliedsecurity
patchesinstalled.Deploycriticalpatcheswithinamonthofrelease.
6.2Establishaprocesstoidentifynewlydiscoveredsecurityvulnerabilities,suchasbysubscribing
toalertservices,orusingavulnerabilityscanningserviceorsoftware.Updatetheprocessto
addressnewvulnerabilityissues.
6.3DevelopsoftwareapplicationsinaccordancewithPCIDSSbasedonindustrybestpracticesand
incorporateinformationsecuritythroughoutthesoftwaredevelopmentlifecycle.
6.4Followchangecontrolproceduresforallchangestosystemcomponents.

18
6.5DevelopallWebapplicationsbasedonsecurecodingguidelinesandreviewcustomapplication
codetoidentifycodingvulnerabilities.
6.6EnsurethatallpublicWeb-facingapplicationsareprotectedagainstknownattackswithatleast
annualreviewsofcode,andbyinstallingaWebapplicationfirewallinfrontofpublic-facingWeb
applications.
ImplementStrongAccessControlMeasures
Accesscontrolallowsmerchantstopermitordenytheuseofphysicalortechnicalmeanstoaccess
PANandothercardholderdata.Accessmustbegrantedonabusinessneed-to-knowbasis.Physical
accesscontrolentailstheuseoflocksorrestrictedaccesstopaper-basedcardholderrecordsorsystem
hardware.LogicalaccesscontrolpermitsordeniesuseofPINentrydevices,awirelessnetwork,PCs
andotherdevices.Italsocontrolsaccesstodigitalfilescontainingcardholderdata.
Requirement7:Restrictaccesstocardholderdatabybusinessneed-to-know
Toensurecriticaldatacanonlybeaccessedbyauthorizedpersonnel,systemsandprocessesmustbe
inplacetolimitaccessbasedonneed-to-knowandaccordingtojobresponsibilities.Need-to-knowis
whenaccessrightsaregrantedtoonlytheleastamountofdataandprivilegesneededtoperformajob.
7.1Limitaccesstosystemcomponentsandcardholderdatatoonlythoseindividualswhosejob
requiressuchaccess.
7.2Establishanaccesscontrolsystemforsystemscomponentswithmultipleusersthatrestricts
accessbasedonauser’sneed-to-know,andissetto“denyall”unlessspecificallyallowed.
RESTRICTINGACCESS
ISCRUCIAL!
RestrictAccesstoCardholderData
Environmentsemployingaccess
controlssuchasRBAC(RoleBased
AccessControl)
Limitaccesstoonlythose
individualswhosejobrequiressuch
access
Formalizeanaccesscontrolpolicy
thatincludesalistofwhogets
accesstospecifiedcardholderdata
Denyallaccesstoanyonewhois
notspecificallyallowedtoaccess
cardholderdata
Photo:WikimediaCommons

19
Requirement8:AssignauniqueIDtoeachpersonwithcomputeraccess
Assigningauniqueidentification(ID)toeachpersonwithaccessensuresthatactionstakenoncritical
dataandsystemsareperformedby,andcanbetracedto,knownandauthorizedusers.
8.1Assignallusersauniqueusernamebeforeallowingthemtoaccesssystemcomponentsor
cardholderdata.
8.2Employatleastoneofthesetoauthenticateallusers:passwordorpassphrase;ortwo-factor
authentication(e.g.,tokendevices,smartcards,biometrics,publickeys).
8.3Implementtwo-factorauthenticationforremoteaccesstothenetworkbyemployees,
administrators,andthirdparties.Usetechnologiessuchasremoteauthenticationanddial-
inserviceorterminalaccesscontrolleraccesscontrolsystemwithtokens;orvirtualprivate
networkwithindividualcertificates.
8.4Renderallpasswordsunreadableforallsystemcomponentsbothinstorageandduring
transmissionusingstrongcryptographybasedonapprovedstandards.
8.5Ensureproperuserauthenticationandpasswordmanagementfornon-consumerusersand
administratorsonallsystemcomponents.
GIVEEVERYUSERA
UNIQUEID
Everyuseronthepaymentsystem
musthaveauniqueID.Thisallows
abusinesstotraceeveryactiontoa
specificworker.

20
Requirement9:Restrictphysicalaccesstocardholderdata
Anyphysicalaccesstodataorsystemsthathousecardholderdataprovidestheopportunityfor
personstoaccessand/orremovedevices,data,systemsorhardcopies,andshouldbeappropriately
restricted.
9.1Useappropriatefacilityentrycontrolstolimitandmonitorphysicalaccesstosystemsinthe
cardholderdataenvironment.
9.2Developprocedurestohelpallpersonneleasilydistinguishbetweenemployeesandvisitors,
especiallyinareaswherecardholderdataisaccessible.
9.3Ensureallvisitorsareauthorizedbeforeenteringareaswherecardholderdataisprocessedor
maintained;givenaphysicaltokenthatexpiresandthatidentifiesvisitorsasnon-employees;
andareaskedtosurrenderthephysicaltokenbeforeleavingthefacilityoratthedateof
expiration.
9.4Useavisitorlogtomaintainaphysicalaudittrailofvisitorinformationandactivity.Retainthe
logforatleastthreemonthsunlessotherwiserestrictedbylaw.
9.5Storemediaback-upsinasecurelocation,preferablyoffsite.
9.6Physicallysecureallpaperandelectronicmediathatcontaincardholderdata.
9.7Maintainstrictcontrolovertheinternalorexternaldistributionofanykindofmediathat
containscardholderdata.
9.8Ensurethatmanagementapprovesanyandallmediacontainingcardholderdatamovedfroma
securedarea,especiallywhenmediaisdistributedtoindividuals.
PHYSICALLYSECURETHE
PAYMENTSYSTEM
Businessesmustphysicallysecure
orrestrictaccesstoprintoutsof
cardholderdata,tomediawhere
itisstored,andtodevicesusedfor
accessingorstoringcardholder
data.It’simportanttounderstand
thatPCIisaboutprotectingboth
electronicdataandpaperreceipts
aswell.
Illustration:WikimediaCommons

21
9.9Maintainstrictcontroloverthestorageandaccessibilityofmediathatcontainscardholderdata.
9.10Destroymediacontainingcardholderdatawhenitisnolongerneededforbusinessorlegal
reasons.
RegularlyMonitorandTestNetworks
Physicalandwirelessnetworksaretheglueconnectingallendpointsandserversinthepayment
infrastructure.Vulnerabilitiesinnetworkdevicesandsystemspresentopportunitiesforcriminalsto
gainunauthorizedaccesstopaymentcardapplicationsandcardholderdata.Topreventexploitation,
organizationsmustregularlymonitorandtestnetworkstofindandfixvulnerabilities.
Requirement10:Trackandmonitorallaccesstonetworkresourcesandcardholderdata
Loggingmechanismsandtheabilitytotrackuseractivitiesarecriticalforeffectiveforensicsand
vulnerabilitymanagement.Thepresenceoflogsinallenvironmentsallowsthoroughtrackingand
analysisifsomethinggoeswrong.Determiningthecauseofacompromiseisverydifficultwithout
systemactivitylogs.
10.1Establishaprocessforlinkingallaccesstosystemcomponentstoeachindividualuser–
especiallyaccessdonewithadministrativeprivileges.
10.2Implementautomatedaudittrailsforallsystemcomponentsforreconstructingtheseevents:
allindividualuseraccessestocardholderdata;allactionstakenbyanyindividualwithroot
oradministrativeprivileges;accesstoallaudittrails;invalidlogicalaccessattempts;useof
identificationandauthenticationmechanisms;initializationoftheauditlogs;creationand
deletionofsystem-levelobjects.
MONITORALLACTIVITY
Organizationsmusttrackand
monitorallaccesstocardholder
dataandrelatednetworkresources
–instores,regionaloffices,
headquarters,andotherremote
access.
Photo:WikimediaCommons

22
10.3Recordaudittrailentriesforallsystemcomponentsforeachevent,includingataminimum:user
identification,typeofevent,dateandtime,successorfailureindication,originationofevent,
andidentityornameofaffecteddata,systemcomponentorresource.
10.4Synchronizeallcriticalsystemclocksandtimes.
10.5Secureaudittrailssotheycannotbealtered.
10.6Reviewlogsforallsystemcomponentsrelatedtosecurityfunctionsatleastdaily.
10.7Retainaudittrailhistoryforatleastoneyear;atleastthreemonthsofhistorymustbe
immediatelyavailableforanalysis.
Requirement11:Regularlytestsecuritysystemsandprocesses
Vulnerabilitiesarebeingdiscoveredcontinuallybymaliciousindividualsandresearchers,and
beingintroducedbynewsoftware.Systemcomponents,processes,andcustomsoftwareshouldbe
testedfrequentlytoensuresecurityismaintainedovertime.Testingofsecuritycontrolsisespecially
importantforanyenvironmentalchangessuchasdeployingnewsoftwareorchangingsystem
configurations.
11.1Testforthepresenceofwirelessaccesspointsbyusingawirelessanalyzeratleastquarterly,or
deployingawirelessIDS/IPStoidentifyallwirelessdevicesinuse.
11.2Runinternalandexternalnetworkvulnerabilityscansatleastquarterlyandafteranysignificant
changeinthenetwork.ASVsarenotrequiredtoperforminternalscans.
11.3Performexternalandinternalpenetrationtestingatleastonceayearandafteranysignificant
infrastructureorapplicationupgradeormodification,includingnetwork-andapplication-layer
penetrationtests.
SEVERITYLEVELS
FORVULNERABILITY
SCANNING
5Urgent:Trojanhorses;fileread
andwriteexploit;remotecommand
execution
4Critical:PotentialTrojanhorses;
filereadexploit
3High:Limitedexploitofread;
directorybrowsing;DoS
2Medium:Sensitive
configurationinformationcanbe
obtainedbyhackers
1Low:Informationcan
beobtainedbyhackerson
configuration
“Tobeconsideredcompliant,a
componentmustnotcontain
vulnerabilitiesassignedLevel3,4,
or5.Tobeconsideredcompliant,all
componentswithinthecustomer
infrastructuremustbecompliant.
Thescanreportmustnotinclude
anyvulnerabilitiesthatindicate
featuresorconfigurationsthatmay
violatePCIDSSrequirements.”

23
11.4Usenetworkintrusiondetectionsystemsand/orintrusionpreventionsystemstomonitorall
trafficinthecardholderdataenvironmentandalertpersonneltosuspectedcompromises.IDS/
IPSenginesmustbekeptuptodate.
11.5Deployfileintegritymonitoringsoftwaretoalertpersonneltounauthorizedmodificationof
criticalsystemfiles,configurationfilesorcontentfiles.Configurethesoftwaretoperformcritical
filecomparisonsatleastweekly.
MaintainanInformationSecurityPolicy
Astrongsecuritypolicysetsthetoneforsecurityaffectinganorganization’sentirecompany,andit
informsemployeesoftheirexpecteddutiesrelatedtosecurity.Allemployeesshouldbeawareofthe
sensitivityofcardholderdataandtheirresponsibilitiesforprotectingit.
Requirement12:Maintainapolicythataddressesinformationsecurityforemployees
andcontractors
12.1Establish,publish,maintain,anddisseminateasecuritypolicythataddressesallPCIDSS
requirements,includesanannualprocessforidentifyingvulnerabilitiesandformallyassessing
risks,andincludesareviewatleastonceayearandwhentheenvironmentchanges.
12.2DevelopdailyoperationalsecurityproceduresthatareconsistentwithrequirementsinPCIDSS.
12.3Developusagepoliciesforcriticalemployee-facingtechnologiestodefinetheirproperusefor
allemployeesandcontractors.Theseincluderemoteaccess,wireless,removableelectronic
media,laptops,handhelddevices,emailandInternet.
12.4Ensurethatthesecuritypolicyandproceduresclearlydefineinformationsecurity
responsibilitiesforallemployeesandcontractors.
“PCIDSSrepresentsthebest
availableframeworktoguidebetter
protectionofcardholderdata.
Italsopresentsanopportunity
toleveragecardholderdata
securityachievedthroughPCIDSS
complianceforbetterprotectionof
othersensitivebusinessdata–and
toaddresscompliancewithother
standardsandregulations.”
AberdeenGroup
ITIndustryAnalyst

24
12.5Assigntoanindividualorteaminformationsecurityresponsibilitiesdefinedby12.5subsections.
12.6Implementaformalsecurityawarenessprogramtomakeallemployeesawareoftheimportance
ofcardholderdatasecurity.
12.7Screenemployeespriortohiretominimizetheriskofattacksfrominternalsources.
12.8Ifcardholderdataissharedwithserviceproviders,thenrequirethemtoimplementPCIDSS
policiesandproceduresforcardholderdatasecurity.
12.9Implementanincidentresponseplan.Bepreparedtorespondimmediatelytoasystembreach.
CompensatingControlsforPCISecurity
CompensatingcontrolsmaybeconsideredformostPCIDSSrequirementswhenanentitycannot
meetarequirementexplicitlyasstated,duetolegitimatetechnicalordocumentedbusiness
constraints,buthassufficientlymitigatedtheriskassociatedwiththerequirementthrough
implementationofcompensatingcontrols.Inorderforacompensatingcontroltobeconsidered
valid,itmustbereviewedbyaQSA.Theeffectivenessofacompensatingcontrolisdependentonthe
specificsoftheenvironmentinwhichthecontrolisimplemented,thesurroundingsecuritycontrols,
andtheconfigurationofthecontrol.Organizationsshouldbeawarethataparticularcompensating
controlwillnotbeeffectiveinallenvironments.SeethePCIDSSversion1.2,AppendicesBandCfor
details.

25
HowtoComplywithPCIDSS
Merchantsandorganizationsthatstore,processand/ortransmitcardholderdatamustcomplywith
PCIDSSversion1.2.WhiletheCouncilisresponsibleformanagingthedatasecuritystandards,each
cardbrandmaintainsitsownseparatecomplianceenforcementprograms.Eachcardbrandhas
definedspecificrequirementsforvalidationofcomplianceandreporting,suchasprovisionsforself-
assessmentversususingaQualifiedSecurityAssessor.
Dependingonanorganization’sclassificationorrisklevel(determinedbytheindividualcardbrands),
processesforvalidatingcomplianceandreportingtoacquiringfinancialinstitutionsusuallyfollow
thistrack:
1.PCIDSSScoping–determinewhatsystemcomponentsaregovernedbyPCIDSS
2.Sampling–examinethecomplianceofasubsetofsystemcomponentsinscope
3.CompensatingControls–QSAvalidatesalternativecontroltechnologies/processes
4.Reporting–merchant/organizationsubmitsrequireddocumentation
5.Clarifications–merchant/organizationclarifies/updatesreportstatements(ifapplicable)
uponbankrequest
HowtoComply
WithPCIDSS

26
Specificquestionsaboutcompliancevalidationlevelsshouldbedirectedtoyouracquiringfinancial
institution.Onlytheacquiringfinancialinstitutioncanassignavalidationleveltomerchants.Linksto
cardbrandcomplianceprogramsinclude:
•AmericanExpress:•www.americanexpress.com/datasecurity
•DiscoverFinancialServices:•www.discovernetwork.com/fraudsecurity/disc.html
•JCBInternational:•www.jcb-global.com/english/pci/index.html
•MasterCardWorldwide:•www.mastercard.com/sdp
•VisaInc:•www.visa.com/cisp
VisaEurope:•www.visaeurope.com/ais
ChoosingaQualifiedSecurityAssessor
AQualifiedSecurityAssessor(QSA)isadatasecurityfirmthathasbeentrainedandiscertifiedbythe
PCISecurityStandardsCounciltoperformon-sitesecurityassessmentsforverificationofcompliance
withPCIDSS.TheQSAwill:
•Verifyalltechnicalinformationgivenbymerchantorserviceprovider
•Useindependentjudgmenttoconfirmthestandardhasbeenmet
•Providesupportandguidanceduringthecomplianceprocess
•Beonsiteforthevalidationoftheassessmentordurationasrequired
•ReviewtheworkproductthatsupportsthePCIRequirementsandSecurityAssessmentProcedures
•EnsureadherencetothePCISecurityAssessmentProcedures
•Definethescopeoftheassessment
•Selectsystemsandsystemcomponentswheresamplingisemployed
•Evaluatecompensatingcontrols
•Producethefinalreport
PREPARINGFORAPCI
DSSASSESSMENT
GatherDocumentation:
Securitypolicies,changecontrol,
networkdiagrams,PCIlettersand
notifications
ScheduleResources:Ensure
participationofaprojectmanager
andkeypeoplefromIT,security,
applications,humanresourcesand
legal
DescribetheEnvironment:
Organizeinformationaboutthe
cardholderdataenvironment,
includingcardholderdataflow
andlocationofcardholderdata
repositories

27
TheQSAyouselectshouldhavesolidunderstandingofyourbusinessandhaveexperiencein
assessingthesecurityofsimilarorganizations.ThatknowledgehelpstheQSAtounderstandbusiness
sector-specificnuancesofsecuringcardholderdataunderPCIDSS.Also,lookforagoodfitwithyour
company’sculture.Theassessmentwillconcludewhetheryouarecompliantornot–buttheQSAwill
alsoworkwithyourorganizationtounderstandhowtoachieveandmaintaincompliance.ManyQSAs
alsocanprovideadditionalsecurity-relatedservicessuchasongoingvulnerabilityassessmentand
remediation.AlistofQSAsisavailableatwww.pcisecuritystandards.org/qsa_asv/find_one.shtml.
ChoosinganApprovedScanningVendor
AnApprovedScanningVendor(ASV)isadatasecurityfirmusingascanningsolutiontodetermine
whetherornotthecustomeriscompliantwiththePCIDSSexternalvulnerabilityscanning
requirement.ASVshavebeentrainedandarequalifiedbythePCISecurityStandardsCouncilto
performnetworkandsystemsscansasrequiredbythePCIDSS.AnASVmayuseitsownsoftware
oranapprovedcommercialoropensourcesolutiontovalidatecompliance.ASVsolutionsmustbe
non-disruptivetocustomers’systemsanddata–theymustnevercauseasystemreboot,orinterfere
withorchangedomainnameserver(DNS)routing,switching,andaddressresolution.Root-kitsor
othersoftwareshouldnotbeinstalledunlesspartofthesolutionandpre-approvedbythecustomer.
TestsnotpermittedbytheASVsolutionincludedenialofservice,bufferoverflow,bruteforceattack
resultinginapasswordlockout,orexcessiveusageofavailablecommunicationbandwidth.
AnASVscanningsolutionincludesthescanningtool(s),theassociatedscanningreport,andthe
processforexchanginginformationbetweenthescanningvendorandthecustomer.ASVsmay
submitcompliancereportstotheacquiringinstitutiononbehalfofamerchantorserviceprovider.
AlistofASVsisavailableatwww.pcisecuritystandards.org/qsa_asv/find_one.shtml.

28
UsingtheSelf-AssessmentQuestionnaire
The“SAQ”isaself-validationtoolformerchantsandserviceproviderswhoarenotrequiredtodo
on-siteassessmentsforPCIDSScompliance.TheSAQincludesaseriesofyes-or-noquestionsfor
compliance.Ifananswerisno,theorganizationmuststatethefutureremediationdateandassociated
actions.Inordertoalignmorecloselywithmerchantsandtheircompliancevalidationprocess,the
SAQwasrevisedandnowallowsforflexibilitybasedonthecomplexityofaparticularmerchant’sor
serviceprovider’sbusinesssituation(seechartbelow).TheSAQvalidationtypedoesnotcorrelateto
themerchantclassificationorrisklevel.
Self-AssessmentQuestionnaires
SAQValidation
Type
DescriptionSAQ
1Card-Not-Present(e-commerceorMO/TO)merchants,allcardholderdata
functionsoutsourced.Thiswouldneverapplytoface-to-facemerchants.
A
2Imprint-onlymerchantswithnocardholderdatastorage.B
3Standalonedial-upterminalmerchants,nocardholderdatastorage.B
4MerchantswithpaymentapplicationsystemsconnectedtotheInternet,no
cardholderdatastorage.
C
5Allothermerchants(notincludedindescriptionsforSAQsA,BorCabove),and
allserviceprovidersdefinedbyacardbrandaseligibletocompleteaSAQ.
D

29
WebResources
Reporting
Reportsaretheofficialmechanismbywhichmerchantsandotherorganizationsverifycompliance
withPCIDSStotheirrespectiveacquiringfinancialinstitutions.Dependingoncardbrand
requirements,merchantsandserviceprovidersmayneedtosubmitaSAQorannualattestations
ofcomplianceforon-siteassessments(seePCIDSSversion1.2,AppendicesDandEformore
information).Quarterlysubmissionofareportfornetworkscanningmayalsoberequired.Finally,
individualcardbrandsmayrequiresubmissionofotherdocumentation;seetheirWebsitesformore
information(URLslistedabove).
InformationContainedinPCIDSSReports
•SummaryofFindings(generalstatement,detailsofthesecurityassessment)
•BusinessInformation(contact,businessdescription,processorrelationships)
•CardPaymentInfrastructure(networkdiagram,transactionflowdiagram,POSproductsused,
wirelessLANsand/orwirelessPOSterminals)
•ExternalRelationships(listserviceproviderswithwhomyousharecardholderdata,connections
tocardpaymentcompanies,whollyownedentities(nationalandinternational)thatrequire
compliancewithPCIDSS
COMPLIANCEPROGRAM
Assess
AssessyournetworkandIT
resourcesforvulnerabilities.You
shouldconstantlymonitoraccess
andusageofcardholderdata.Log
datamustbeavailableforanalysis
Remediate
Youmustfixvulnerabilitiesthat
threatenunauthorizedaccessto
cardholderdata
Report
Reportcomplianceandpresent
evidencethatdataprotection
controlsareinplace

30
WebResources
PCISecurityStandardsCouncilWebsite
www.pcisecuritystandards.org
FrequentlyAskedQuestions(FAQ)
www.pcisecuritystandards.org/faq.htm
MembershipInformation
www.pcisecuritystandards.org/participation/join.shtml
Webinars
www.pcisecuritystandards.org/news_events/events.shtml
Training(forassessors)
QSAs:www.pcisecuritystandards.org/education/qsa_training.shtml
PA-DSS:www.pcisecuritystandards.org/education/pa-dss_training.shtml
PTSapproveddevices
PINTransactionSecurity(PTS)Devices:www.pcisecuritystandards.org/security_standards/ped/pedapprovallist.html
PaymentApplications:www.pcisecuritystandards.org/security_standards/pa_dss.shtml
PCIDataSecurityStandardversion1.2(PCIDSS)
TheStandard:www.pcisecuritystandards.org/tech/download_the_pci_dss.htm
SupportingDocuments:www.pcisecuritystandards.org/security_standards/pci_dss_supporting_docs.shtml
ApprovedAssessorsandScanningVendors:www.pcisecuritystandards.org/about/resources.shtml
NavigatingtheStandard:www.pcisecuritystandards.org/security_standards/pci_dss_supporting_docs.shtml
Self-AssessmentQuestionnaire:www.pcisecuritystandards.org/saq/index.shtml
Glossary:www.pcisecuritystandards.org/security_standards/pci_dss_supporting_docs.shtml
ApprovedQSAs:www.pcisecuritystandards.org/qsa_asv/find_one.shtml
ApprovedASVs:www.pcisecuritystandards.org/qsa_asv/find_one.shtml

31
AboutthePCI
SecurityStandards
Council
AboutthePCISecurityStandardsCouncil
ThePCISecurityStandardsCouncil(PCISSC)isaglobalopenbodyformedtodevelop,enhance,
disseminateandassistwiththeunderstandingofsecuritystandardsforpaymentaccountsecurity.
TheCouncilmaintains,evolves,andpromotesthePaymentCardIndustrysecuritystandards.Italso
providescriticaltoolsneededforimplementationofthestandardssuchasassessmentandscanning
guidelines,aself-assessmentquestionnaire,trainingandeducation,andproductcertification
programs.
ThePCISSCfoundingmembers,AmericanExpress,DiscoverFinancialServices,JCBInternational,
MasterCardWorldwide,andVisaInc.,haveagreedtoincorporatethePCIDataSecurityStandardas
partofthetechnicalrequirementforeachoftheirdatasecuritycomplianceprograms.Eachfounding
memberalsorecognizestheQualifiedSecurityAssessorsandApprovedScanningVendorsqualified
bythePCISSCtoassesscompliancewiththePCIDSS.
ThePCISSC’sfoundingmembercardbrandsshareequallyintheCouncil’sgovernanceand
operations.Otherindustrystakeholdersparticipateinreviewingproposedadditionsormodifications
tothestandards,includingmerchants,paymentcardissuingbanks,processors,hardwareand
softwaredevelopers,andothervendors.
PCISSCFOUNDERS
PARTICIPATING
ORGANIZATIONS
Merchants,Banks,Processors,
HardwareandSoftwareDevelopers
andPoint-of-SaleVendors

PCIDataSecurityStandard
ThePCIDSSversion1.2isasetofcomprehensiverequirementsforenhancingpaymentaccountdatasecurity.Itrepresentscommonsense
stepsthatmirrorsecuritybestpractices.Learnmoreaboutitsrequirements,securitycontrolsandprocesses,andstepstoassesscompliance
insidethisPCIQuickReferenceGuide.
GoalsPCIDSSRequirements
BuildandMaintainaSecureNetwork1.Installandmaintainafirewallconfigurationtoprotectcardholderdata
2.Donotusevendor-supplieddefaultsforsystempasswordsandothersecurityparameters
ProtectCardholderData3.Protectstoredcardholderdata
4.Encrypttransmissionofcardholderdataacrossopen,publicnetworks
MaintainaVulnerabilityManagement
Program
5.Useandregularlyupdateanti-virussoftwareorprograms
6.Developandmaintainsecuresystemsandapplications
ImplementStrongAccessControl
Measures
7.Restrictaccesstocardholderdatabybusinessneed-to-know
8.AssignauniqueIDtoeachpersonwithcomputeraccess
9.Restrictphysicalaccesstocardholderdata
RegularlyMonitorandTestNetworks10.Trackandmonitorallaccesstonetworkresourcesandcardholderdata
11.Regularlytestsecuritysystemsandprocesses
MaintainanInformationSecurityPolicy12.Maintainapolicythataddressesinformationsecurityforemployeesandcontractors

PCI Quick Reference Guide

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to PCI Quick Reference Guide

Similar to PCI Quick Reference Guide (20)

Recently uploaded

Recently uploaded (17)

PCI Quick Reference Guide