PCI DSS

Payment Card Industry (PCI) Security Standards Council – Data Security Standard

Title:	Payment Card Industry (PCI) Security Standards Council – Data Security Standard
Source reference:	https://www.pcisecuritystandards.org/
Topic:	Requirements for the management of data security of payment accounts
Direct / indirect relevance	Direct. While a private sector initiative, the text directly deals with information security in the financial sector.
Scope:	The document contains a number of requirements aiming to improve data security of payment accounts. It was drafted and maintained by the PCI Security Standards Council, whose members include American Express, Discover Financial Services, JCB, MasterCard Worldwide and Visa International.
Legal force:	Not legally binding
Affected sectors:	Members of the payment card industry and related service providers
Relevant provision(s):	PCI DSS contains high level requirements for security management, including policies, procedural recommendations, architectural recommendations, software design and other critical protective measures. The content of PCI DSS is summarily described as follows: “The core of the PCI DSS is a group of principles and accompanying requirements, around which the specific elements of the DSS are organized: Build and Maintain a Secure Network • Requirement 1: Install and maintain a firewall configuration to protect cardholder data • Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data • Requirement 3: Protect stored cardholder data • Requirement 4: Encrypt transmission of cardholder data across open, public networks Maintain a Vulnerability Management Program • Requirement 5: Use and regularly update anti-virus software • Requirement 6: Develop and maintain secure systems and applications Implement Strong Access Control Measures • Requirement 7: Restrict access to cardholder data by business need-to-know • Requirement 8: Assign a unique ID to each person with computer access • Requirement 9: Restrict physical access to cardholder data Regularly Monitor and Test Networks • Requirement 10: Track and monitor all access to network resources and cardholder data • Requirement 11: Regularly test security systems and processes Maintain an Information Security Policy • Requirement 12: Maintain a policy that addresses information security” (Source: https://www.pcisecuritystandards.org/tech/index.htm)
Relevance to RM/RA:	The main purpose of PCI DSS was to provide central guidance allowing financial service providers relying on payment cards to implement the necessary policies, procedures and infrastructure to adequately safeguard their customer account data. Thus, the document is one of the major RM/RA resources in the payment card industry. PCI DSS has no formal binding legal power. None the less, considering its origins and the key participants, it holds significant moral authority, and non-compliance with the PCI DSS by a payment card service provider may be indicative of inadequate RM/RA practices.

Browse the Topics