The 12 requirements
- 1. Install and maintain network security controls.
- 2. Apply secure configurations to all system components.
- 3. Protect stored account data.
- 4. Protect cardholder data with strong cryptography during transmission over open, public networks.
- 5. Protect all systems and networks from malicious software.
- 6. Develop and maintain secure systems and software.
- 7. Restrict access by business need to know.
- 8. Identify users and authenticate access.
- 9. Restrict physical access to cardholder data.
- 10. Log and monitor all access.
- 11. Test the security of systems and networks regularly.
- 12. Support information security with policies and programmes.
How compliance is validated
It depends on your transaction volume and on the card brands' or your acquirer's rules: a Report on Compliance by a qualified assessor, or a Self-Assessment Questionnaire for smaller merchants. Ask your acquirer which applies.
Reduce the scope first
- Do not store card data unless you need to.
- Use a hosted payment page or a validated provider where you can.
- Segment the network around what remains.
- Remember that outsourcing payments does not remove every duty.
Questions
- Is PCI DSS a law?
- No. It is a contractual standard set by the PCI Security Standards Council and enforced through card brands and acquirers. Some jurisdictions refer to it in law.
- Does using a payment provider make you compliant?
- It can reduce your scope considerably, but you must still validate compliance for what remains and manage that provider.