What is the PCI-DSS Compliance?
The PCI-DSS is an information processing standard that provides a framework for protecting payment card transactions and cardholder details from fraudsters. It specifies a set of baseline measures you must put in place to help minimize the risk of cardholder data compromise.
Who needs to be PCI-DSS compliant?
The standard applies to any business or organization that accepts or processes card payments. So it predominantly affects retail businesses and any company that provides software or hardware used to process transactions.
What are the 12 requirements of PCI-DSS Compliance?
The PCI-DSS Compliance specifies twelve technical and operational requirements as follows:
- Install and Maintain a Firewall Configuration to Protect Cardholder Data
- Do Not Use Vendor-Supplied Defaults for System Passwords and Other Security Parameters
- Protect Stored Cardholder Data
- Encrypt Transmission of Cardholder Data across Open, Public Networks
- Use and Regularly Update Antivirus Software or Programs
- Develop and Maintain Secure Systems and Applications
- Restrict Access to Cardholder Data by Business Need to Know
- Assign a Unique ID to Each Person with Computer Access
- Restrict Physical Access to Cardholder Data
- Track and Monitor All Access to Network Resources and Cardholder Data
- Regularly Test Security Systems and Processes
- Maintain a Policy That Addresses Information Security for Employees and Contractors