ZenGRC

Simply Powerful GRC

PCI DSS Compliance: A Brief Overview

· ·

Compliance with the Payment Card Industry Data Security Standard (PCI DSS) means meeting 12 specific compliance requirements. If your organization processes credit- or debit card payments, you must comply with them.

What are the 12 PCI DSS compliance requirements?

  1. Install and maintain a firewall to protect cardholder data.
  2. Do not use vendor-supplied defaults for system passwords and other security parameters.
  3. Protect stored cardholder data.
  4. Encrypt transmission of cardholder data across open, public networks.
  5. Use and regularly update antivirus software.
  6. Develop and maintain secure systems and applications.
  7. Restrict access to cardholder data by business need-to-know.
  8. Assign a unique ID to each person with computer access to prevent unauthorized access.
  9. Restrict physical access to cardholder data.
  10. Track and monitor all access to network resources and cardholder data.
  11. Regularly test security systems and processes.
  12. Maintain a policy that addresses information security.

In detail below, we’ll explore these requirements and how to comply with each. But first, let’s determine whether your entity needs to comply with PCI DSS and to what extent. If you’re preparing for a PCI DSS compliance audit and want to ensure success, download our free audit guide.

What is PCI DSS?

Visa, MasterCard, Discover Financial Services, JCB International, and American Express came together to develop the Payment Card Industry Data Security Standard (PCI DSS), a set of security guidelines, in 2004.

The Payment Card Industry Security Standards Council (PCI SSC) oversees the compliance program, which protects credit and debit card transactions from fraud and data theft.

It is a requirement for every company that conducts credit or debit card transactions, even if the PCI SSC has the legal ability to enforce compliance. The finest method for protecting sensitive data and information is also seen to be PCI certification, which aids companies in establishing enduring and reliable partnerships with their clients.

PCI DSS: Who Needs to Comply?

You may wonder who needs PCI DSS? The Payment Card Industry Data Security Standard (PCI DSS) is an information security framework intended to help merchants and service providers protect credit and debit card transactions from data breaches.

PCI DSS is not a law or regulation but an industry mandate. Your enterprise must be PCI-compliant if it accepts credit card payments or handles payment card data.

PCI DSS Compliance: Where to Begin

Twelve requirements don’t seem like a lot. But each PCI DSS requirement has directives and sub-requirements for 281. Only some of these directives pertain to some organizations, however.

To save time, money, and hassle, you’ll want to begin your PCI DSS compliance journey with scoping, in which you determine which requirements and directives are relevant to your enterprise.

Scoping begins with understanding which PCI DSS level your organization belongs to. The higher the level, the more requirements you’ll need to follow.

The Four PCI DSS Compliance Levels

The PCI Security Standards Council (PCI SSC), comprising major credit-card companies and other financial organizations, has established four PCI compliance levels.

Your organization’s status depends on how many payment-card transactions you process yearly and which cards you accept. Generally, the stories are as follows:

  • PCI Compliance Level 1: More than six million Visa, Mastercard, or Discover or more than 2.5 million American Express transactions per year
  • PCI Compliance Level 2: More than 1 million to 6 million Visa or Mastercard or more than 50,000 American Express transactions per year
  • PCI Compliance Level 3: 20,000 to 1 million Visa or Mastercard transactions, or fewer than 50,000 American Express transactions per year
  • PCI Compliance Level 4: Fewer than 20,000 Visa or Mastercard eCommerce transactions per year and fewer than 1 million total Visa or Mastercard credit card transactions, and no data breach or attack that compromised card or cardholder data

Those falling in merchant levels 2, 3, or 4 must complete the PCI DSS Self-Assessment Questionnaire (SAQ) annually and assess their network security every quarter.
Level 1 merchants must do much more:

  • File an Annual Report on Compliance (ROC) by a Qualified Security Assessor (QSA) or Internal Security Assessor
  • Submit the results of quarterly network vulnerability scans by an Approved Scan Vendor (ASV)
  • Complete the PCI SSC Attestation of Compliance (AOC) form

What are the Benefits of PCI DSS Compliance?

It is accurate to claim that eCommerce has remained the leading market during the past few years. However, growing worries regarding the security of client information regarding online financial transactions go hand in hand with this trend.
PCI Compliance becomes relevant at this point.

Being PCI compliant has various advantages for e-commerce businesses.
Cut down on data leaks. For example, we secure the data of our client’s credit cards from online attacks.

  • You can avoid paying fines for security flaws or data breaches. You are securing client data as securely as possible if you are PCI compliant.
  • Customers’ brand reputation and trust may be enhanced when they purchase on your website.
  • Protect your clients and your company while advancing global payment card security solutions
  • You will be better equipped to comply with other PCI DSS standards like SOX and HIPAA as you progress toward PCI Compliance.

PCI compliance is mandated by courts even if it is not required by legislation. You must safeguard clients’ private financial information when you take card payments.

PCI DSS Compliance Checklist

The PCI DSS requirements fall into six categories. Here we list the categories, followed by the requirements that fall under them, and a brief explanation of what compliance with each entails.

Finally, check out our ultimate guide, PCI DSS Compliance Explained, for detailed information on every aspect of PCI DSS, including compliance levels, scoping, and the 12 requirements.

Build and Maintain a Secure Network

  1. Install and maintain a firewall to protect cardholder data: Review firewall configurations every six months, at minimum. Your firewalls should:
    1. Test changes and identify system connections that might affect cardholder data
    2. Deny traffic from “untrusted” networks and hosts
    3. Block public access to the cardholder data environment
    4. Be installed on every mobile or employee-owned computer that connects to your network.
  2. Do not use vendor-supplied defaults for system passwords and other security parameters.
    1. When adding a system, change its defaults before installing it-including defaults on wireless devices.
    2. Ensure your software settings address known security vulnerabilities and meet industry requirements.
    3. Encrypt everything.
    4. Make sure that hosting providers are protecting your information and your cardholders’ sensitive data.

Protect Cardholder Data

Cardholder data includes credit card data and debit card data: any information printed, processed, transmitted, or stored in any form on a payment card.

  1. Protect Stored Cardholder Data
    1. Do not store authentication information, even if it is encrypted.
    2. Do not display the Primary Account Numbers (PAN).
    3. Mask PANs wherever they are held, and minimize the places where you store them.
    4. Protect cryptographic keys.
    5. Document all the ways you use encryption and protect cryptographic keys.
  2. Encrypt Transmission of Cardholder Data Across Open, Public Networks
    1. Use Secure Socket Layer/Transport Layer Security (SSL/TLS) encryption when transmitting data. Follow industry best practices, and don’t use outmoded Wired Equivalent Privacy (WEP) with your wireless system.
    2. Always encrypt PANs before transmission.

Maintain a Vulnerability Management Program

  1. Use and Regularly Update Antivirus Software
    1. Continually update antivirus software and install patches promptly.
    2. Install antivirus software and anti-malware on all systems, particularly personal ones, that could be attacked by malicious software.
    3. Ensure that antivirus software and programs are up-to-date, actively used, and generate logs for your auditors.
  1. Develop and Maintain Secure Systems and Applications
    1. Install vendor-supplied security updates within one month after their release.
    2. Use an alert system to identify new vulnerabilities.
    3. Use PCI DSS best practices end-to-end when developing a new system.
    4. Follow your policies and procedures when making a control change.
    5. Meet coding guidelines when developing web-based applications so that you can identify vulnerabilities.
    6. If you have a general, web-facing application, protect against known attacks by reviewing the code and installing the needed firewall.

Implement Strong Access Control Measures

  1. Restrict Access to Cardholder Data by Business Need-to-Know
    1. Limit access to system components to only those who need them.
    2. For systems components with multiple users, provide each person only with what they need to perform their job.
    3. Control user access to cardholder data.
  2. Assign a Unique ID to Each Person with Computer Access
    1. Limit access to systems and data based on the minimum information necessary for the job.
    2. Use at least one type of authentication, but preferably more.
    3. Provide remote workers with two-factor authentication or, even more preferable, multi-factor.
    4. Encrypt password information.
    5. Make sure that every non-consumer has proper authentication and password management.
  3. Restrict Physical Access to Cardholder Data
    1. Place appropriate controls and monitoring on access to physical information.
    2. Create procedures that clearly state who is allowed in each material area. This includes employees and visitors.
    3. Authorize visitors with a physical token that expires upon leaving the facility or on a specific date.
    4. Keep a visitor log.
    5. Make sure all media backups are off-site and protected.
    6. Lock up the paper and electronic media containing cardholder data.
    7. Control the use of media containing cardholder data.
    8. Provide management with information on and approval of the location and movement of data.
    9. Strictly control storage and access to media.
    10. Destroy data once you no longer need it using established protocols.

Regularly Monitor and Test Networks

  1. Track and Monitor All Access to Network Resources and Cardholder Data
    1. Provide users with individual access rights and document and monitor their access, especially users with administrative privileges.
    2. Develop automated audit trails to track entry to your information environment in case there’s a security breach.
    3. Synchronize all clocks.
    4. Lockdown audit trails to prevent tampering.
    5. Review logs daily.
    6. Retain audit documentation for at least one year and immediate history for at least three months.
  1. Regularly Test Security Systems and Processes
    1. Use wireless Intrusion Detection Systems (IDS)/Intrusion Prevention Systems (IPS) to identify wireless devices connected to your design at least every quarter so you know all wireless access points.
    2. Scan for internal and external vulnerabilities quarterly or after a significant network change.
    3. Perform external and internal penetration testing at least once a year or after considerable infrastructure or application upgrades.
    4. Monitor traffic into and out of your cardholder data environment. Keep IDS/IPS engines up to date.
    5. Deploy alerts to your Information Technology (IT) department about unauthorized modification of system files, configuration files, or content files.

Maintain an Information Security Policy

  1. Maintain a Policy that Addresses Information Security
    1. Create an information security policy and distribute it to all users of your system and network; verify that all have read it. Please review the policy annually to ensure it protects your current Cardholder Data Environment (CDE).
    2. Assign daily security duties that meet PCI requirements.
    3. Write procedures for employee and contractor access to company technology and information, and share the policies with affected users.
    4. Clearly define the rights and responsibilities of employees and contractors.

Let ZenGRC Help You Maintain PCI DSS Compliance.

The penalties for PCI DSS non-compliance can be severe and crippling to any organization. If you fail to meet the requirements, the PCI SSC council could revoke your rights to process payment cards. The commission is serious about protecting cardholder data and insists you be.

Following the rules is the best way to keep those card-processing rights intact. And the best way to follow the PCI DSS rules is to use software to automate your compliance, alert you when you stray, and document your efforts to help you pass those dreaded certification audits effortlessly.

ZenGRC all these tasks and more. Our software:

  • Probes your system and networks to determine where you comply with more than a dozen regulatory and industry frameworks and where you fall short
  • Displays findings on an easy-to-read dashboard with checklists telling you precisely what to do to fill compliance gaps
  • Tracks workflows so that you always know where your compliance efforts stand
  • It helps you generate vendor questionnaires and compiles responses.
  • Alerts you in real-time to compliance gaps
  • Conducts unlimited self-audits with a few clicks
  • Documents all your compliance activities in our patented “Single Source of Truth” repository for a complete audit trail

Compliance with PCI DSS needn’t be a hassle or a dream. The modern, worry-free path is just a click away. So contact us now to schedule a demo and embark on the journey to PCI DSS compliance, the Zen way.