PCI DSS

Types

PCI DSS compliance is categorized into different levels based on the volume of credit card transactions an organization handles annually:

• Level 1: Over 6 million transactions per year.
• Level 2: 1 million to 6 million transactions per year.
• Level 3: 20,000 to 1 million e-commerce transactions annually.
• Level 4: Fewer than 20,000 e-commerce transactions or up to 1 million other transactions annually.

Standards and Requirements

The PCI DSS is built around six primary goals, comprising a total of 12 requirements:

• Build and Maintain a Secure Network and Systems:

  • Install and maintain a firewall configuration to protect cardholder data.
  • Do not use vendor-supplied defaults for system passwords and other security parameters.

• Protect Cardholder Data:

  • Protect stored cardholder data.
  • Encrypt transmission of cardholder data across open, public networks.

• Maintain a Vulnerability Management Program:

  • Protect all systems against malware and regularly update anti-virus software or programs.
  • Develop and maintain secure systems and applications.

• Implement Strong Access Control Measures:

  • Restrict access to cardholder data by business need to know.
  • Identify and authenticate access to system components.
  • Restrict physical access to cardholder data.

• Regularly Monitor and Test Networks:

  • Track and monitor all access to network resources and cardholder data.
  • Regularly test security systems and processes.

• Maintain an Information Security Policy:

  • Maintain a policy that addresses information security for all personnel.

Importance

Ensuring PCI DSS compliance is critical for protecting customer data, maintaining trust, and avoiding substantial penalties and fines from regulatory bodies. All organizations, regardless of size, that accept, transmit, or store credit card information must comply with PCI DSS standards.

Related Terms

• Tokenization: Replacing sensitive card information with unique identification symbols (tokens) that retain essential information without compromising security.
• EMV: A technical standard for smart payment cards and terminals to ensure secure transactions.
• Data Breach: An incident where sensitive, protected, or confidential data is accessed or disclosed in an unauthorized way.

FAQs