About PCI DSS

The Payment Card Industry Data Security Standard, or PCI DSS, is an industry standard for all organizations that handle cardholder data. This data can include credit cards, debit cards, ATM cards, and point of sale (POS) cards. The standard protects cardholder data and minimizes the possibility of cardholder data theft and/or loss. PCI DSS requires that all merchants, service providers, and financial institutions meet minimum levels of security and monitoring of the systems in their cardholder data environment (CDE).

The Data Security Standard is made up of 12 requirements that businesses are expected to comply with. These requirements consist of security policies, procedures, and guidelines for storage, processing, and transmission of cardholder data.

High-level Overview of the PCI Data Security Standard
Build and Maintain a Secure Network	1. Install and maintain a firewall connection to protect cardholder data. 2. Do not use vendor-supplied defaults for system passwords and other security parameters.
Protect Cardholder Data	3. Protect stored cardholder data. 4. Encrypt transmission of cardholder data across open, public networks.
Maintain a Vulnerability Management Program	5. Use and regularly update antivirus software or programs. 6. Develop and maintain secure systems and applications.
Implement Strong Access Control Measures	7. Restrict access to cardholder data by what a business needs to know. 8. Assign a unique ID to each person with computer access. 9. Restrict physical access to cardholder data.
Regularly Monitor and Test Networks	10. Track and monitor all access to network resources and cardholder data. 11. Regularly test security systems and processes.
Maintain an Information Security Policy	12. Maintain a policy that addresses information security for personnel.

Any business that stores, processes, or transmits payment cardholder data is required to regularly monitor its CDE in accordance with the PCI DSS standard.