Browse Definitions :
Definition

PCI DSS Requirements Fast Guide

In 2004, the Payment Card Industry Security Standards Council created 6 control objectives and 12 specific requirements for protecting credit card data. Collectively, the control objectives and specific requirements are known as PCI DSS.  All major credit card companies have mandated that members, merchants and service providers who store, process or transmit cardholder data must demonstrate how they follow the requirements.  Failure to do so may result in fines or termination of credit card processing privileges.

Build and maintain a secure network

Requirement 1: Install and maintain a firewall configuration to protect cardholder data
  Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

Protect cardholder data

Requirement 3: Protect stored cardholder data
  Requirement 4: Encrypt transmission of cardholder data across open, public networks

Maintain a vulnerability management program

Requirement 5: Use and regularly update anti-virus software
  Requirement 6: Develop and maintain secure systems and applications

Implement strong access control measures

Requirement 7: Restrict access to cardholder data by business need-to-know
  Requirement 8: Assign a unique ID to each person with computer access
  Requirement 9: Restrict physical access to cardholder data

Regularly monitor and test networks

Requirement 10: Track and monitor all access to network resources and cardholder data
  Requirement 11: Regularly test security systems and processes

Maintain an information security policy

Requirement 12: Maintain a policy that addresses information security

 

Continue reading about PCI DSS compliance:

The PCI DSS Security Standards Council provides a deeper explanation of each requirement.

Video guide: PCI DSS and the 12 Requirements

Guide to passing PCI's five toughest requirements

Visual timeline: The history of PCI DSS

This was last updated in March 2012

SearchCompliance

  • information governance

    Information governance is a holistic approach to managing corporate information by implementing processes, roles, controls and ...

  • enterprise document management (EDM)

    Enterprise document management (EDM) is a strategy for overseeing an organization's paper and electronic documents so they can be...

  • risk assessment

    Risk assessment is the identification of hazards that could negatively impact an organization's ability to conduct business.

SearchSecurity

  • cracker

    A cracker is someone who breaks into someone else's computer system, often on a network; bypasses passwords or licenses in ...

  • Malware quiz: Test your knowledge of types and terms

    Malware trends are constantly evolving, but older techniques are still often used in cyber attacks today. Test your knowledge of ...

  • digital signature

    A digital signature is a mathematical technique used to validate the authenticity and integrity of a message, software or digital...

SearchHealthIT

SearchDisasterRecovery

  • risk mitigation

    Risk mitigation is a strategy to prepare for and lessen the effects of threats faced by a business.

  • call tree

    A call tree is a layered hierarchical communication model that is used to notify specific individuals of an event and coordinate ...

  • Disaster Recovery as a Service (DRaaS)

    Disaster recovery as a service (DRaaS) is the replication and hosting of physical or virtual servers by a third party to provide ...

SearchStorage

  • storage virtualization

    Storage virtualization is the pooling of physical storage from multiple storage devices into what appears to be a single storage ...

  • erasure coding

    Erasure coding (EC) is a method of data protection in which data is broken into fragments, expanded and encoded with redundant ...

  • continuous data protection

    Continuous data protection (CDP), also known as continuous backup, is a backup and recovery storage system in which all the data ...

Close