Browse Definitions :
Definition

PCI DSS Requirements Fast Guide

In 2004, the Payment Card Industry Security Standards Council created 6 control objectives and 12 specific requirements for protecting credit card data. Collectively, the control objectives and specific requirements are known as PCI DSS.  All major credit card companies have mandated that members, merchants and service providers who store, process or transmit cardholder data must demonstrate how they follow the requirements.  Failure to do so may result in fines or termination of credit card processing privileges.

Build and maintain a secure network

Requirement 1: Install and maintain a firewall configuration to protect cardholder data
  Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

Protect cardholder data

Requirement 3: Protect stored cardholder data
  Requirement 4: Encrypt transmission of cardholder data across open, public networks

Maintain a vulnerability management program

Requirement 5: Use and regularly update anti-virus software
  Requirement 6: Develop and maintain secure systems and applications

Implement strong access control measures

Requirement 7: Restrict access to cardholder data by business need-to-know
  Requirement 8: Assign a unique ID to each person with computer access
  Requirement 9: Restrict physical access to cardholder data

Regularly monitor and test networks

Requirement 10: Track and monitor all access to network resources and cardholder data
  Requirement 11: Regularly test security systems and processes

Maintain an information security policy

Requirement 12: Maintain a policy that addresses information security

 

Continue reading about PCI DSS compliance:

The PCI DSS Security Standards Council provides a deeper explanation of each requirement.

Video guide: PCI DSS and the 12 Requirements

Guide to passing PCI's five toughest requirements

Visual timeline: The history of PCI DSS

This was last updated in March 2012

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.

-ADS BY GOOGLE

File Extensions and File Formats

SearchCompliance

SearchSecurity

  • time-based one-time password (TOTP)

    A time-based one-time password (TOTP) is a temporary code, generated by an algorithm, for use in authenticating access to ...

  • Security Operations Center (SOC)

    A security operations center (SOC) is a command center facility for a team of IT professionals with expertise in information ...

  • incident response team

    An incident response team is a group of IT professionals in charge of preparing for and reacting to any type of organizational ...

SearchHealthIT

SearchDisasterRecovery

  • disaster recovery team

    A disaster recovery team is a group of individuals focused on planning, implementing, maintaining, auditing and testing an ...

  • cloud insurance

    Cloud insurance is any type of financial or data protection obtained by a cloud service provider. 

  • business continuity software

    Business continuity software is an application or suite designed to make business continuity planning/business continuity ...

SearchStorage

  • storage class memory (SCM)

    Storage class memory (SCM) is a type of NAND flash that includes a power source to ensure that data won't be lost due to a system...

  • Hadoop as a service (HaaS)

    Hadoop as a service (HaaS), also known as Hadoop in the cloud, is a big data analytics framework that stores and analyzes data in...

  • blockchain storage

    Blockchain storage is a way of saving data in a decentralized network which utilizes the unused hard disk space of users across ...

Close