The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. Created by the Payment Card Industry Security Standards Council (PCI SSC), this standard aims to protect cardholder data from theft and ensure secure payment systems.
PCI DSS compliance is enforced by acquiring banks and card brands. Fines can range from $5,000-$100,000 per month, and other penalties can include increased transaction fees or termination of the ability to accept card payments.
Depending on the annual volume of transactions, companies may need to complete regular security audits by a Qualified Security Assessor (QSA) or complete a Self-Assessment Questionnaire (SAQ).
Key security requirements:
PCI DSS is structured around six core goals, which are divided into twelve key requirements.
1. Build and Maintain a Secure Network and Systems
- Requirement 1: Install and maintain a firewall configuration to protect cardholder data.
- Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters.
2. Protect Cardholder Data
- Requirement 3: Protect stored cardholder data.
- Requirement 4: Encrypt transmission of cardholder data across open, public networks.
3. Maintain a Vulnerability Management Program
- Requirement 5: Use and regularly update antivirus software.
- Requirement 6: Develop and maintain secure systems and applications.
4. Implement Strong Access Control Measures
- Requirement 7: Restrict access to cardholder data by business need-to-know.
- Requirement 8: Identify and authenticate access to system components.
- Requirement 9: Restrict physical access to cardholder data.
5. Regularly Monitor and Test Networks
- Requirement 10: Track and monitor all access to network resources and cardholder data.
- Requirement 11: Regularly test security systems and processes. This includes running scans which are from “Approved Scanning Vendors, commonly known as ASV scans, which is a PCI hard requirement.
6. Maintain an Information Security Policy
- Requirement 12: Maintain a policy that addresses information security for all personnel.
