A global data security standard governs how entities store, process, and transmit cardholder data (CHD) and/or sensitive authentication data (SAD). The Payment Card Industry Security Standards Council administers the standard, and major payment card brands enforce its use. The standard was created to improve and streamline the security controls organizations use when handling sensitive payment data.
Applicability and Compliance Levels
PCI DSS applies to any entity that handles credit card information, whether it accepts payments or stores, processes, and transmits card data. Different levels of PCI DSS compliance are based on the number of transactions an organization processes annually. The larger the volume of transactions, the more rigorous the compliance requirements.
- Scope: PCI DSS covers the entire payment processing lifecycle, including the hardware, software, personnel, and networks handling cardholder data.
12 Core Requirements
PCI DSS outlines 12 specific requirements for organizations to protect cardholder data:
- Firewall Configuration: Install and maintain a firewall configuration to protect cardholder data.
- Default Passwords: Do not use vendor-supplied defaults for system passwords and other security parameters.
- Encryption: Protect stored cardholder data by implementing encryption and other techniques.
- Transmission Encryption: Encrypt transmission of cardholder data across open, public networks.
- Anti-virus Software: Use and regularly update anti-virus software or programs.
- Secure Systems: Develop and maintain secure systems and applications with timely updates and patches.
- Access Control: Restrict access to cardholder data based on a need-to-know basis.
- Unique IDs: Assign a unique ID to each person with computer access to ensure accountability.
- Physical Access: Restrict physical access to cardholder data.
- Monitoring: Track and monitor all access to network resources and cardholder data.
- Testing: Regularly test security systems and processes to identify vulnerabilities.
- Security Policy: Maintain a policy that addresses information security for all personnel.
Audits and Penalties
Organizations must regularly assess their compliance with PCI DSS through internal or third-party audits. Non-compliance can result in penalties, fines, or the loss of the ability to process card payments.
Evolving Requirements
PCI DSS evolves to address new security threats and technologies, making it necessary for businesses to stay updated on the latest standard versions. Following the standards helps businesses protect sensitive payment data and reduce the risk of fraud.
