Where Does It Fit in PCI DSS?

PCI DSS is the Payment Card Industry Data Security Standard. The card brands set it in 2004, and anyone who stores, processes or transmits card data has to meet it, anywhere in the world. It is an industry standard enforced through contracts, not a law, and it is far more technical than a privacy law. PCI DSS groups its twelve requirements under six goals. The lesson names four of them. Vulnerability management program: protect systems from malware (anti-malware that stays on and up to date) and build and keep systems and software secure (critical patches within a month, payment code written to resist attacks). Strong access control: limit card data to staff whose job needs it, give each person their own ID with a second factor for the card environment, and control physical access to systems and media. Monitoring and testing the network: log and review access to card data, and test security regularly (wireless sweeps, change detection on payment pages, penetration tests). The testers have to be qualified and independent of what they test; they can be an outside firm, as the video says, or a qualified internal team. Information security policy: written security rules reviewed each year, awareness training, an incident response plan, and someone in charge. The other two goals are building and keeping a secure network, and protecting account data. Compliance levels depend on how many card transactions a business handles a year. The largest merchants are assessed on site each year, usually by a Qualified Security Assessor; smaller ones fill in a Self-Assessment Questionnaire. How long data is kept does not set the level, as the video suggests.