PCI-DSS (Payment Card Industry Data Security Standards) is a set of security standards designed to ensure that all companies that accept, process, store or transmit credit card information maintain a secure environment. The PCI-DSS standards were created by major credit card companies such as Visa, MasterCard, American Express and Discover to protect sensitive cardholder data and reduce the risk of credit card fraud.
The PCI-DSS standards include 12 requirements that are grouped into six categories:
- Build and Maintain a Secure Network: This includes requirements for firewalls, secure routers and other network devices.
- Protect Cardholder Data: This includes requirements for protecting sensitive cardholder data such as encryption, access controls and data backup.
- Maintain a Vulnerability Management Program: This includes requirements for identifying and mitigating security vulnerabilities.
- Implement Strong Access Control Measures: This includes requirements for controlling access to cardholder data and monitoring system activity.
- Regularly Monitor and Test Networks: This includes requirements for monitoring network activity and testing security controls.
- Maintain an Information Security Policy: This includes requirements for developing and maintaining a comprehensive security policy.
Organizations that handle credit card information must comply with the PCI-DSS standards and must demonstrate compliance through regular assessments by a Qualified Security Assessor (QSA) or Internal Security Assessor (ISA). PCI DSS compliance is mandatory for any merchant who accepts credit card payments and non-compliance can lead to hefty fines and penalties. Additionally, non-compliance can also lead to loss of trust from customers and business partners. Organizations are expected to maintain the compliance on an ongoing basis.
