PCI DSS

• Build and maintain a secure network and systems using firewalls to protect cardholder data, and ensure that vendor-supplied defaults for system passwords and other security parameters are not used.
• Protect cardholder data and encrypt its transmission across open, public networks.
• Maintain a vulnerability management program with secure systems and applications, plus regular updates to anti-virus software and programs.
• Implement strong access control measures by restricting access to cardholder data (both electronic and physical) on a “need to know” basis.
• Regularly monitor and test networks and track all access to cardholder data.
• Maintain an information security policy that addresses information security for all personnel.

• All merchants that accept credit card payments are required to comply with the DSS, even if they have outsourced payment processing. Engaging a QSA can help ensure your company stays in accordance with the contracted terms of your acquirer.
• Third-party providers of certain services to merchants may need to assess their own compliance with DSS in order to provide those merchants assurance with regard to the outsourced services.
• Compliance with the DSS establishes a solid baseline for security practices as it relates to the cardholder data environment (CDE). The DSS aligns well with other security standards (e.g. ISO 27001, NIST SP 800-53) and can easily be extrapolated across the rest of your organization.

Visit the PCI DSS website for more information on the goals and requirements.