Payment Card Industry Data Security Standards
New Standards (Version 3.0)
PCI Data Security Standards Overview
The PCI Security Standards Council offers robust and comprehensive standards and supporting materials to enhance payment card data security. These materials include a framework of specifications, tools, measurements and support resources to help organizations ensure the safe handling of cardholder information at every step.
PCI Data Security Standard - High Level Overview:
- Build and Maintain a Secure Network
- Install and maintain a firewall configuration to protect data
- Do not use vendor-supplied defaults for system passwords and other security parameters
- Protect Cardholder Data
- Protect stored cardholder data
- Encrypt transmission of cardholder data across open, public networks
- Maintain a Vulnerability Management Program
- Use and regularly update anti-virus software or programs
- Develop and maintain secure systems and applications
- Implement Strong Access Control Measures
- Restrict access to cardholder data by business need to know
- Assign a unique ID to each person with computer access
- Restrict physical access to cardholder data
- Regularly Monitor and Test Networks
- Track and monitor all access to network resources and cardholder data
- Regularly test security systems and processes
- Maintain an Information Security Policy
- Maintain a policy that addresses information security for all personnel
PCI DSS Self-Assessments
All merchants should complete the designated self-assessment for their merchant. Completion of the appropriate self-assessment ensures that you fully understand your processes and operations, that you are educated and are held accountable concerning PCI policy and procedures, and that you recognize and remediate any security flaws.
- Category 1 - All credit card processing is outsourced.
- Category 2 - Merchant only processes payments using a dial up (copper phone line or cellular) terminal.
- Category 3 - Transmit and process cardholder data via payment applications but cardholder data is not stored electronically.
- Category 4 - Merchant only processes payments using a web-based (virtual terminal), and does not store cardholder data electronically.
- Category 5 - Merchant which stores cardholder data in electronic format, or does not fit in categories 1 through 4.
- Category P2PE - Merchants who only process payments using hardware payment terminals included in a validated and PCI SSC-listed PCI point-to-point encryption (P2PE) solution.
PCI DSS applies where ever account data is stored, processed, or transmitted. Account Data consists of Cardholder Data plus Sensitive Authentication Data, as follows:
|Cardholder Data Includes:||Sensitive Authentication Data Includes:|
|Primary Account Number (PAN)||Full magnetic stripe data or equivalent on a chip|
|Cardholder Name||CAV2 / CVC2 / CVV2 / CID|
|Expiration Date||PINs / PIN blocks|
The following table illustrates commonly used elements of cardholder and sensitive authentication data, whether storage of each element is permitted or prohibited, and whether each data element must be protected. This table is not exhaustive, but is presented to illustrate the different types of requirements that apply to each data element.
|Data Element||Storage Permitted||Render Stored Account Data Unreadable per Requirement 3.4|
|Account Data||Cardholder Data||Primary Account Number (PAN)||Yes||Yes|
|Sensitive Authentication Data||Full Magnetic Stripe Data||No||Cannot Store|
|CAV2 / CVC2 / CVV2 / CID||No||Cannot Store|
|PIN / PIN Block||No||Cannot Store|