PCI DSS

Question 1

What does PCI DSS stand for?

Answer 1

Payment Card Industry Data Security Standard

Question 2

What is PCI DSS?

Answer 2

Proprietary standard for organisations who handle payment cards associated with: Visa, MasterCard, American Express, etc.

Question 3

Who administers the PCI standard?

Answer 3

Payment Card Industry Security Standards Council

Question 4

Who performs validation compliance?

Answer 4

A Qualified Security Assessor (QSA), who creates a Report Of Compliance (ROC), or through a Self Assessment Questionnaire (SAQ).

Question 5

What is the latest version?

Answer 5

Version 3.1, released in 2015.

Question 6

How many requirements are specified by the standard?

Answer 6

12 requirements, organised into 6 groups of control objectives.

Question 7

What are the control objectives?

Answer 7

1. Build an maintain a secure network (firewalls and default passwords).
2. Protect card holder data (storage and transmission).
3. Maintain a vulnerability management programme (AV and secure development).
4. Implement strong access control measures (need to know, unique ID, physical access).
5. Regularly monitor and test networks (monitor access, test systems).
6. Maintain an information security policy (policy).

Question 8

What kind of supplementary information is provided?

Answer 8

1. Penetration testing
2. Code reviews and firewall management.
3. PCI DSS wireless guidelines.
4. Call centre management - can’t digitally record conversations that include card numbers.