Regulatory Compliance, Governance and Security

Mar 24 2009   11:49PM GMT

What is Required for PCI Assessment? | PCI DSS Q and A



Posted by: Charles Denyer
Tags:
Build and Maintain a Secure Network
charles denyer
Implement Strong Access Control Measures
Maintain an Information Security Policy
PCI DSS
Protect Cardholder Data
qualified security assessor (QSA)
Regularly Monitor and Test Networks
requirement 12
What is Required for PCI Assessment?

What is required for PCI assessment compliance? This is a question i’m often asked, especially by organizations that need to comply with Level 1 of the PCI DSS standards, which is an on-site assessment conducted by a Qualified Security Assessor (QSA), such as myself. Well, here is what you need to “comply” with according to the PCI standards:

Build and Maintain a Secure Network

* Requirement 1: Install and maintain a firewall configuration to protect cardholder data
* Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data

* Requirement 3: Protect stroed cardholder data
* Requirement 4: Encrypt transmission of cardholder data across open, public networks

Maintain a Vulnerability Management Program

* Requirement 5: Use and regularly update anti-virus software
* Requirement 6: Develop and maintain secure systems and applications

Implement Strong Access Control Measures

* Requirement 7: Restrict access to cardholder data by business need-to-know
* Requirement 8: Assign a unique ID to each person with computer access
* Requirement 9: Restrict physical access to cardholder data

Regularly Monitor and Test Networks

* Requirement 10: Track and monitor all access to network resources and cardholder data
* Requirement 11: Regularly test security systems and processes

Maintain an Information Security Policy

* Requirement 12: Maintain a policy that addresses information security

Sure, it is lengthy and an arduous task, to say the least. Remember though, there are four (4) different levels of compliance for PCI DSS, with most organizations falling into levels 2,3, and 4. Level 1 compliance can be very time consuming, but so can Levels 2,3, and 4 if you do not have a good grasp on what is required by the PCI DSS standards. My recommendation, consult with a PCI QSA on what level you fall into and what assistance you may need.

 Comment on this Post

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when other members comment.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to: