The 12 requirements of the PCI DSS standard
1. Management security requirement
The first requirement of PCI DSS is to have a strong security structure in place, with policies, procedures, and well-defined roles and responsibilities. This requirement is important because it provides a basis for implementing the other requirements of the standard.
Examples of actions to be implemented to comply with the management security requirement
The organization must:
- Designate a Chief Information Security Officer (CISO) who will be responsible for overseeing PCI DSS compliance efforts. The CISO must have the skills and experience to lead the organization's security efforts.
- Establish an information security policy (ISP) that defines the organization's information security objectives and principles. The PSI must be clear, concise and easily accessible to all employees.
- Implement an information security training program for all employees. Training should cover the fundamentals of information security, as well as the specific risks related to payment cardholder data.
2. Network Security Requirement
The second requirement of the PCI DSS standard concerns securing the network against intrusions and attacks. This requirement is important because the network is the gateway for cyberattackers.
Examples of actions to take to comply with the network security requirement
The organization must:
- Install a firewall to block unauthorized access to the network. The firewall must be configured to allow only legitimate connections.
- Limit network access to authorized users. The organization must have policies and procedures in place to control access to the network.
- Establish a vulnerability management process to identify and remediate known vulnerabilities. The organization should conduct regular audits of its network to identify potential vulnerabilities.
3. System security requirement
The third requirement of PCI DSS focuses on securing computer systems against unauthorized access and malicious modifications. This requirement is important because computer systems often contain sensitive data, including payment card holder data.
Examples of actions to be implemented to comply with the system security requirement
The organization must
- Install antivirus and anti-malware software on all computer systems. Antivirus and anti-malware software should be updated regularly to protect systems against the latest threats.
- Update its systems regularly to correct known vulnerabilities. Organizations should have an update management process in place to ensure all systems are up to date.
- Establish a password management process to securely manage user passwords. Passwords should be strong and unique, and they should be changed regularly.
4. Application security requirement
The fourth requirement of PCI DSS focuses on securing software applications against vulnerabilities and attacks. This requirement is important because software applications can be a source of vulnerabilities that can be exploited by cyberattackers.
Examples of actions to implement to comply with the application security requirement
The organization must:
- Establish a secure development process to develop secure applications. The secure development process should include security testing to identify and fix vulnerabilities.
- Update your applications regularly to correct known vulnerabilities. Organizations should have an update management process in place to ensure all applications are up to date
- Implement an access management process to limit access to applications to authorized users. The organization must have policies and procedures in place to control access to applications.
5. Data security requirement
The fifth requirement of PCI DSS focuses on protecting payment cardholder data from unauthorized access, malicious modification, and destruction. This requirement is the most important in the standard, as it aims to protect the organization's most sensitive data.
PCI DSS defines payment cardholder data as follows:
- Credit card numbers, expiration dates and CVV/CVC codes.
- Names and addresses of credit card holders.
- Billing information, such as billing addresses and telephone numbers.
- Security information, such as security questions and answers.
Measures to be put in place to comply with the PCI DSS data security requirement
To comply with Requirement 5, organizations must implement the following measures:
- Store payment card holder data in a secure environment. This means that the data must be stored in a secure physical location, such as a secure data center, and the systems that store the data must be protected from unauthorized access.
- Encrypt payment cardholder data when in transit or stored. Encryption is the process of converting data into an unreadable format without the proper decryption key. Data encryption protects data from unauthorized access, even if it is compromised.
- Eliminate payment card holder data securely. Organizations must ensure that payment cardholder data is disposed of securely, for example by permanently deleting it or physically destroying it.
Specific examples of steps organizations can take to comply with Data Security Requirement 5
- Use firewalls, antivirus and anti-malware software to protect systems that store payment cardholder data.
- Limit access to payment card holder data to authorized persons.
- Implement a strong password policy that requires passwords to be long, complex and changed regularly.
- Use identity and access management (IAM) systems to control access to payment cardholder data.
- Implement a data backup policy that requires payment card holder data to be backed up regularly.
- Regularly test systems and applications to detect vulnerabilities .
- Develop an incident response plan to manage security incidents that arise.
6. Personal safety requirement
The sixth requirement of PCI DSS focuses on making employees aware of security risks and providing appropriate training. This requirement is important because employees are often the first line of defense against cyberattacks.
Examples of actions to be implemented to comply with the personal safety requirement
The organization must:
- Inform its employees of security risks and the measures they must take to protect payment card holder data.
- Implement information security training for all employees. Training should cover the fundamentals of information security, as well as the specific risks associated with payment cardholder data.
- Monitor employee activities to detect suspicious behavior. The organization must have procedures in place to investigate security incidents and take corrective action.
7. Process security requirements
The seventh requirement of PCI DSS focuses on having strong security processes in place to manage risk. This requirement is important because it allows the organization to respond effectively to security incidents.
Examples of actions to be implemented to comply with the personal safety requirement
The organization must put in place a process to:
- Regularly test its systems and applications to detect vulnerabilities.
- Investigate security incidents and take corrective action.
- Document safety procedures. Safety procedures should be clearly defined and easily accessible to all employees.
8. Event Security Requirement
The eighth requirement of PCI DSS focuses on having processes in place to detect and respond to security incidents. This requirement is important because it allows the organization to minimize the damage caused by a cyber attack.
Examples of actions to be implemented to comply with the event security requirement
The organization must put in place a process to:
- Detect security incidents, such as intrusions and data leaks.
- Investigate security incidents and take corrective action.
- Communicate security incidents to relevant stakeholders.
9. Backup Security Requirement
The ninth requirement of PCI DSS focuses on having processes in place to safeguard payment cardholder data. This requirement is important because it allows the organization to quickly recover its data in the event of a security incident.
Examples of actions to take to comply with the backup security requirement
- The organization must have a process in place to back up payment cardholder data regularly.
- Backups should be stored in a secure, offline location.
- Backups should be tested regularly to ensure they are recoverable.
10. Encryption Security Requirement
The tenth requirement of the PCI DSS standard concerns the encryption of payment cardholder data. This requirement is important because it helps protect data from unauthorized access, even if it is compromised.
Examples of actions to take to comply with the encryption security requirement
- The organization must encrypt all payment cardholder data that is stored or transmitted electronically.
- Encryption should be used to protect sensitive data, such as credit card numbers, expiration dates, and CVV/CVC codes.
- Encryption should be used to protect data during transport, including Internet and email transmissions.
11. Physical Access Security Requirement
The eleventh requirement of PCI DSS addresses the physical protection of facilities and data. This requirement is important because it prevents unauthorized access to systems and data.
Examples of actions to be implemented to comply with the physical access security requirement
- The organization must limit physical access to sensitive facilities, such as data centers and server rooms.
- Sensitive facilities should be secured with locked doors and surveillance systems.
- Authorized personnel must be trained on physical security procedures.
12. Surveillance security requirement
The twelfth requirement of PCI DSS addresses monitoring of security activities. This requirement allows the organization to detect anomalies and potential threats and respond accordingly.
Examples of actions to be implemented to comply with Surveillance security requirement
- The organization should implement a monitoring system to monitor network activity, system events and user activities.
- Monitoring should be done in real time and events should be analyzed to detect anomalies.
- Security incidents must be identified and dealt with quickly.
PCI DSS compliance is an ongoing process that requires constant attention and effort from the entire organization. Organizations that want to comply with the standard can get help from certified third parties, such as ASVs (Attestation of Service Validation).
Ziwit Consultancy ServicesManual audits and Pentests on-site or remotely
