Payment Card Industry Data Security Standard (PCI DSS)

The PCI DSS must be met by all organisations (merchants and service providers) that transmit, process or store payment card data. The PCI DSS (sometimes referred to as a compliance standard) is not a law. It is a contractual obligation applied and enforced - by means of fines or other restrictions - directly by the payment providers themselves.

---

PCI DSS Core Principles

The core of the PCI DSS is a group of principles and accompanying requirements, around which the specific elements of the DSS are organised:

Build and Maintain a Secure Network

Requirement 1: Install and maintain a firewall configuration to protect cardholder data

Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters 

Protect Cardholder Data

Requirement 3: Protect stored cardholder data

Requirement 4: Encrypt transmission of cardholder data across open, public networks

Maintain a Vulnerability Management Program

Requirement 5: Use and regularly update anti-virus software

Requirement 6: Develop and maintain secure systems and applications

Implement Strong Access Control Measures

Requirement 7: Restrict access to cardholder data by business need-to-know

Requirement 8: Assign a unique ID to each person with computer access

Requirement 9: Restrict physical access to cardholder data

Regularly Monitor and Test Networks

Requirement 10: Track and monitor all access to network resources and cardholder data

Requirement 11: Regularly test security systems and processes

Maintain an Information Security Policy

Requirement 12: Maintain a policy that addresses information security

---

Castleforce PCI DSS Icons

We have shown the following PCI DSS icon on the Product and Services pages followed by the specific standard section which relates to the link.  If the PCI DSS icon is selected on all other pages it is set to come back to this overview page.

---

PCI DSS Gap Analysis Available

We can provide Gap Analysis to help your organisation understand what they need to do in order to achieve the standards they desire for PCI DSS.  We have already helped a number of Organisations that require PCI DSS, ISO27001 and GCSx CoCo.  It's very important to understand where you may be falling short and what an auditor will be looking for when dealing with complaincy standards and our Gap Analysis can be a step in the right direction.

At Castleforce we utilise the SureCloud scanning services powered by SureGuard which is recognised by the PCI Standards Council.  

The PCI DSS, a set of comprehensive requirements for enhancing payment account data security, was developed by the founding payment brands of the PCI Security Standards Council, including American Express, Discover Financial Services, JCB International, MasterCard Worldwide and Visa Inc. Inc. International, to help facilitate the broad adoption of consistent data security measures on a global basis.

The PCI DSS is a multifaceted security standard that includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures. This comprehensive standard is intended to help organisations proactively protect customer account data.  

 

Castleforce are Partnered with SureCloud that are regiseted on the PCI Standards Council as an Approved Scanning Vendor (ASV).
 

PCI DSS Resources

PCI DSS Requirement 1.2 (PDF)

Self Assessment Questionnaire - Instructions and Guidelines 1.2 (PDF)

Prioritized Approach for PCI DSS 1.2 (PDF)

Self Assessment Questionnaire D