PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards designed to ensure that all companies that process, store, or transmit credit card information maintain a secure environment.

What is PCI DSS?

PCI DSS is a data security standard developed by major credit card brands (Visa, MasterCard, American Express, Discover, JCB) to protect payment card information against fraud and data theft.

Standard Structure

12 Main Requirements

1. Install and maintain a firewall configuration

  • 1.1: Establish and maintain firewall policies and procedures
  • 1.2: Build a firewall configuration that restricts traffic
  • 1.3: Prohibit direct access between Internet and any system component
  • 1.4: Install personal firewall on all mobile devices

2. Do not use vendor-supplied defaults for system passwords

  • 2.1: Change vendor-supplied defaults
  • 2.2: Develop configuration policies for systems
  • 2.3: Encrypt all non-default passwords
  • 2.4: Disable unnecessary accounts

3. Protect stored cardholder data

  • 3.1: Limit cardholder data storage
  • 3.2: Do not store sensitive authentication data
  • 3.3: Mask PAN when displayed
  • 3.4: Render PAN unreadable anywhere it is stored
  • 3.5: Document and implement procedures to protect keys
  • 3.6: Fully document and implement all aspects of key management

4. Encrypt transmission of cardholder data

  • 4.1: Use secure protocols to transmit sensitive data
  • 4.2: Do not send unencrypted PAN by end-user messaging technologies
  • 4.3: Ensure that security policies are documented

5. Use and regularly update anti-virus software

  • 5.1: Deploy anti-virus software on all systems
  • 5.2: Ensure that anti-virus software is updated
  • 5.3: Ensure that anti-virus software is active and running

6. Develop and maintain secure systems and applications

  • 6.1: Establish a process to identify vulnerabilities
  • 6.2: Ensure that all systems have the latest patches
  • 6.3: Develop secure applications following secure practices
  • 6.4: Follow secure development practices
  • 6.5: Address common coding vulnerabilities
  • 6.6: For public-facing web applications, protect against vulnerabilities

7. Restrict access to cardholder data

  • 7.1: Limit access to cardholder data
  • 7.2: Establish a role-based access system
  • 7.3: Restrict physical access to cardholder data

8. Assign a unique ID to each person with computer access

  • 8.1: Assign a unique ID to each person with access
  • 8.2: Verify the identity of each person with access
  • 8.3: Control addition, deletion, and modification of user IDs
  • 8.4: Immediately revoke or modify user access
  • 8.5: Do not use group or shared IDs
  • 8.6: Restrict physical access to cardholder data

9. Restrict physical access to cardholder data

  • 9.1: Use appropriate physical access controls
  • 9.2: Develop procedures to facilitate physical access
  • 9.3: Ensure that all physical media are protected
  • 9.4: Maintain an inventory of all physical media
  • 9.5: Ensure that physical media are destroyed when appropriate

10. Track and monitor all access to network resources

  • 10.1: Implement audit procedures
  • 10.2: Automate audit processes
  • 10.3: Protect audit data against modifications
  • 10.4: Review audit logs at least daily
  • 10.5: Synchronize all system clocks
  • 10.6: Implement procedures to respond to audit failures

11. Regularly test security systems and processes

  • 11.1: Test for presence of wireless access points
  • 11.2: Run external and internal vulnerability scans
  • 11.3: Implement a vulnerability management program
  • 11.4: Use intrusion detection tools
  • 11.5: Deploy intrusion detection tools
  • 11.6: Implement a vulnerability management program

12. Maintain a policy that addresses information security

  • 12.1: Establish, publish, maintain, and disseminate a security policy
  • 12.2: Implement a security awareness program
  • 12.3: Develop acceptable use policies
  • 12.4: Ensure that security policy is documented
  • 12.5: Assign information security responsibilities
  • 12.6: Implement a security awareness program

Compliance Levels

Level 1

  • Criteria: More than 6 million Visa/MasterCard transactions per year
  • Requirements: Annual audit by QSA (Qualified Security Assessor)
  • Report: Report on Compliance (ROC)

Level 2

  • Criteria: 1-6 million Visa/MasterCard transactions per year
  • Requirements: Annual assessment by QSA or SAQ (Self-Assessment Questionnaire)
  • Report: ROC or SAQ

Level 3

  • Criteria: 20,000-1 million Visa/MasterCard transactions per year
  • Requirements: Annual SAQ
  • Report: SAQ

Level 4

  • Criteria: Less than 20,000 Visa/MasterCard transactions per year
  • Requirements: Annual SAQ
  • Report: SAQ

SAQ Types (Self-Assessment Questionnaire)

SAQ A

  • Use: Third-party processors only
  • Requirements: Do not store, process, or transmit card data

SAQ A-EP

  • Use: Merchants with websites that do not collect card data
  • Requirements: Websites that redirect to third-party processors

SAQ B

  • Use: Merchants with point-of-sale terminals only
  • Requirements: Terminals connected by telephone line or IP

SAQ B-IP

  • Use: Merchants with point-of-sale terminals only
  • Requirements: Terminals connected by IP

SAQ C-VT

  • Use: Merchants with virtual terminals only
  • Requirements: Web-based virtual terminals

SAQ C

  • Use: Merchants with payment applications only
  • Requirements: Internet-connected payment applications

SAQ D

  • Use: All other merchants
  • Requirements: Full PCI DSS compliance

Protected Data

Cardholder Data

  • PAN: Primary Account Number
  • Cardholder name: Cardholder name
  • Expiration date: Card expiration date
  • Service code: Card service code

Sensitive Authentication Data

  • CVV/CVC: Card Verification Value/Code
  • PIN: Personal Identification Number
  • Magnetic stripe data: Full magnetic stripe data
  • Chip data: EMV chip data

Compliance Benefits

Security

  • Data protection: Protection of cardholder data
  • Fraud prevention: Reduced fraud risk
  • Risk management: Better security risk management
  • Trust: Increased customer trust

Commercial

  • Payment access: Maintain ability to process payments
  • Fine reduction: Avoid non-compliance fines
  • Competitive advantage: Competitive advantage in the market
  • Reputation: Brand reputation protection

Operational

  • Efficiency: Improved security processes
  • Standards: Implementation of best practices
  • Audit: Structured audit processes
  • Continuous improvement: Continuous improvement process

Standard Implementation

Phase 1: Assessment

  • Inventory: System and data inventory
  • Assessment: Current compliance assessment
  • Gaps: Compliance gap identification
  • Risks: Security risk assessment

Phase 2: Planning

  • Roadmap: Implementation plan
  • Resources: Resource allocation
  • Schedule: Implementation schedule
  • Budget: Budget planning

Phase 3: Implementation

  • Controls: Security control implementation
  • Processes: Process establishment
  • Training: Staff training
  • Documentation: Policy and procedure documentation

Phase 4: Validation

  • Audit: Compliance audit
  • Testing: Security testing
  • Certification: Compliance certification
  • Maintenance: Compliance maintenance

Tools and Resources

Assessment Tools

  • PCI DSS Self-Assessment Questionnaire: Self-assessment questionnaire
  • PCI DSS Prioritized Approach: Prioritized approach
  • PCI DSS Quick Reference Guide: Quick reference guide
  • PCI DSS Implementation Guide: Implementation guide

Security Tools

  • Network Scanners: Network scanners
  • Vulnerability Scanners: Vulnerability scanners
  • File Integrity Monitoring: File integrity monitoring
  • Log Management: Log management

Use Cases

E-commerce

  • Online stores: E-commerce websites
  • Marketplaces: Marketplace platforms
  • Subscriptions: Subscription services
  • Donations: Donation platforms

Point of Sale

  • Physical stores: Point-of-sale terminals
  • Restaurants: Restaurant point-of-sale systems
  • Gas stations: Gas station terminals
  • Pharmacies: Pharmacy systems

Financial Services

  • Banks: Bank payment processing
  • Fintech: Financial technology companies
  • Processors: Payment processors
  • Acquirers: Payment acquirers

Best Practices

Implementation

  1. Executive commitment: Obtain management commitment
  2. Complete assessment: Perform exhaustive assessment
  3. Detailed planning: Develop detailed plan
  4. Gradual implementation: Implement gradually
  5. Continuous monitoring: Monitor continuously

Maintenance

  1. Regular audits: Perform regular audits
  2. Continuous training: Continuous staff training
  3. Updates: Keep compliance updated
  4. Continuous improvement: Continuous program improvement
  5. Documentation: Keep documentation updated

References

Glossary

  • PAN: Primary Account Number
  • CVV/CVC: Card Verification Value/Code
  • PIN: Personal Identification Number
  • QSA: Qualified Security Assessor
  • SAQ: Self-Assessment Questionnaire
  • ROC: Report on Compliance
  • AOC: Attestation of Compliance
  • PCI SSC: PCI Security Standards Council