PCI DSS

The Payment Card Industry Data Security Standard (PCI DSS) is a worldwide security standard defined by the Payment Card Industry Security Standards Council. The standard was created to help organizations that process card payments prevent credit card fraud through increased controls around data and its exposure to compromise.

PCI applies to ALL organizations or merchants, regardless of size or number of transactions, that accepts, transmits or stores any cardholder data. Said another way, if any customer of that organization ever pays the merchant directly using a credit card or debit card, then the PCI DSS requirements apply.

PCI DSS Requirements

• Install and maintain a firewall configuration to protect cardholder data
• Do not use vendor-supplied defaults for system passwords and other security parameters

• Protect stored cardholder data
• Encrypt transmission of cardholder data across open, public networks

• Use and regularly update anti-virus software
• Develop and maintain secure systems and applications

• Restrict access to cardholder data by business need-to-know
• Assign a unique ID to each person with computer access
• Restrict physical access to cardholder data

• Track and monitor all access to network resources and cardholder data
• Regularly test security systems and processes

• Maintain a policy that addresses information security

Usage: "Our site is currently working on our PCI DSS compliance."

Related terms:

• PA-DSS