Compliance
PCI Compliance & Vulnerability Management
Payment Card Industry Data Security Standard (PCI DSS)
PCI-DCC Compliance
& Vulnerability
Management
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security guidelines for any business that accepts credit card payments, requiring that they maintain the safety of their customer data. They cover everything from how data is stored and transmitted to how it is processed and safeguarded, thereby helping to prevent credit card fraud and other types of data breaches.
To comply with PCI DSS, businesses must put in place a number of security measures, including encrypting data, creating restricted access to databases, and scanning and testing for vulnerabilities in systems and applications. Only one part of the PCI DSS concerns vulnerability management, but unlike other standards like ISO 27001 and SOC 2, there are a strict set of requirements for vulnerability scanning and management that must be followed precisely to gain compliance.
PCI Security Standards
There are six key areas of security requirements that businesses must meet in order to comply with PCI DSS (and avoid a hefty fine)
- Build and maintain a secure network, ensuring that all systems and software are up to date with the latest security patches
- Instate and maintain firewalls, encryption and antivirus software
- Protect how credit card data is collected, processed and stored, both digitally and physically
- Maintain a vulnerability management program with regular vulnerability scans and penetration tests of all systems and networks and a prompt program for remediation
- Implement strong control measures to restrict who can access credit card data
- Maintain and enforce a company-wide information security policy