The Payment Card Industry Data Security Standard (PCI DSS) is an information security industry standard intended to help merchants and service providers protect credit and debit card transactions from data breaches. The PCI Security Standards Council (PCI SSC) demands that entities not only become PCI compliant, but also demonstrate a continual commitment to securing credit card data.
PCI DSS Certification Process
Compliance with the PCI DSS means adhering to the twelve requirements established by the PCI SSC:
Install and maintain a firewall configuration to protect cardholder data.
Do not use vendor-supplied defaults for system passwords and other security parameters.
Protect stored cardholder data.
Encrypt transmission of cardholder data across open, public networks.
Use and regularly update antivirus software.
Develop and maintain secure systems and applications.
Restrict access to cardholder data by business need-to-know.
Assign a unique ID to each person with computer access.
Restrict physical access to cardholder data.
Track and monitor all access to network resources and cardholder data.
Regularly test security systems and processes.
Maintain a policy that addresses information security.