QuickGuide: PCI Guidelines at a glance

PCI DSS (Payment Card Industry Data Security Standard) is an industry mandate. If your enterprise accepts credit card payments or handles payment card data, it must comply with PCI DSS. 

Here are the 12 key requirements set by PCI DSS –

1. Install and maintain a firewall configuration to protect data
2. Do not use vendor-supplied defaults for system passwords and other security parameters
3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across open, public networks
5. Protect all systems against malware and regularly update anti-virus software or programs
6. Develop and maintain secure systems and applications
7. Restrict access to cardholder data by business need to know
8. Identify and authenticate access to system components
9. Restrict physical access to cardholder data
10. Track and monitor all access to network resources and cardholder data
11. Regularly test security systems and processes
12. Maintain a policy that addresses information security for all personnel

Here’s a quick tip – requirements 1, 2, 3, 4, 6, 8 and 10 can be greatly simplified by hosting your CDE on a public cloud provider like AWS or Oracle Cloud. Moreover, if your PCI environment is 100% contained within AWS or OCI, you can N/A Requirement 9!

Follow me on LI to learn more on how to Simplify PCI Compliance.