What are the PCI DSS requirements?
PCI DSS comprises 12 requirements, often referred to as the ‘digital dozen’. These define the need to: • Install and maintain a firewall configuration to protect cardholder data. • Do not use vendor supplied defaults of system passwords and other security parameters • Protect stored cardholder data • Encrypt transmission of cardholder data across open, public networks. • Use and regularly update antivirus software or programs • Develop and maintain secure systems and applications • Restrict access to cardholder data by business need-to-know. • Assign a unique ID to each person with computer access • Restrict physical access to cardholder data • Track and monitor all access to network resources and cardholder data • Regularly test security systems and processes • Maintain a policy that addresses information security for employees and contractors.
