Skip to main content

PCI-DSS Requirements

Last Updated: 2025-02-17 Status: Complete

PCI-DSS contains 12 high-level requirements organized into 6 control objectives. Understanding these requirements is essential for building and maintaining compliant payment systems.

Quick Reference​

CategoryRequirementsFocus Area
Build Secure Network1-2Network controls, configurations
Protect Cardholder Data3-4Data storage, transmission
Vulnerability Management5-6Malware, secure development
Access Control7-9Authentication, physical security
Monitoring & Testing10-11Logging, vulnerability testing
Security Policy12Policies and procedures

The 12 Requirements​

Requirement 1: Network Security Controls​

Install and maintain network security controls

Sub-RequirementDescription
1.1Define and implement network security policies
1.2Configure network controls to restrict traffic
1.3Control network connections to/from CDE
1.4Control traffic within CDE and connected systems
1.5Document and manage all firewall rules

Key Implementation:

  • Firewall between internet and CDE
  • Firewall between internal network and CDE
  • Personal firewall on all devices connecting to CDE

Requirement 2: Secure Configurations​

Apply secure configurations to all system components

Sub-RequirementDescription
2.1Change vendor defaults and remove unnecessary defaults
2.2Develop and implement configuration standards
2.3Encrypt all non-console admin access

Key Implementation:

  • Configuration standards for all system types
  • No vendor-default passwords
  • Disabled unnecessary services and protocols

Requirement 3: Protect Stored Data​

Protect stored account data

Sub-RequirementDescription
3.1Keep cardholder data storage to a minimum
3.2Do not store sensitive authentication data after authorization
3.3Mask PAN when displayed
3.4Render PAN unreadable when stored
3.5Protect all keys used to secure stored data
3.6Document key management procedures
3.7Use strong cryptography key management

Critical: Never store CVV, PIN, or full magnetic stripe data after authorization.

Requirement 4: Protect Data in Transit​

Protect cardholder data with strong cryptography during transmission

Sub-RequirementDescription
4.1Protect cardholder data over open public networks
4.2Protect PAN during transmission with strong cryptography

Key Implementation:

  • TLS 1.2 or higher for all cardholder data transmission
  • No PAN in unencrypted channels (email, IM, SMS)
  • Certificate validation and management

Requirement 5: Malware Protection​

Protect all systems and networks from malware

Sub-RequirementDescription
5.1Deploy anti-malware on all systems
5.2Ensure malware mechanisms are maintained
5.3Enable anti-malware on all removable media
5.4Implement anti-phishing mechanisms

Requirement 6: Secure Development​

Develop and maintain secure systems and software

Sub-RequirementDescription
6.1Identify and manage security vulnerabilities
6.2Develop software securely
6.3Identify and address security vulnerabilities
6.4Protect public-facing web applications
6.5Change management for all system components

Key v4.0 Changes:

RequirementNew in v4.0Impact
6.4.3Inventory all scripts on payment pagesTrack JavaScript
11.6.1Detect unauthorized page changesMonitor for tampering

Requirement 7: Restrict Access by Need-to-Know​

Restrict access to system components and cardholder data

Sub-RequirementDescription
7.1Define access control policies
7.2Implement least privilege
7.3Access control via managed access control system

Key Implementation:

  • Role-based access control (RBAC)
  • Default deny all access
  • Document and approve all access grants

Requirement 8: Identify and Authenticate​

Identify users and authenticate access to system components

Sub-RequirementDescription
8.1Manage user identification and assignment
8.2Use unique user IDs
8.3Implement strong authentication
8.4Implement MFA for access to CDE
8.5Manage use of system/application accounts
8.6Maintain strict authentication controls

Key v4.0 Changes:

Requirementv4.0 ChangePrevious
8.3.6Minimum 12 characters7 characters
8.4.2MFA for ALL CDE accessAdmin only

Requirement 9: Physical Security​

Restrict physical access to cardholder data

Sub-RequirementDescription
9.1Implement physical access controls
9.2Manage entry to sensitive areas
9.3Control physical access to network jacks
9.4Control visitor physical access
9.5Protect POI devices from tampering

Requirement 10: Logging and Monitoring​

Log and monitor all access to system components and cardholder data

Sub-RequirementDescription
10.1Implement audit trails
10.2Implement automated audit trails for all system components
10.3Record audit trail entries for all events
10.4Synchronize system clocks
10.5Secure audit logs
10.6Review logs and security events
10.7Retain audit log history

Log Retention:

  • Online: Minimum 3 months immediately available
  • Archive: Minimum 12 months total retention

Requirement 11: Security Testing​

Test security of systems and networks regularly

Sub-RequirementDescription
11.1Test for unauthorized wireless access points
11.2Identify and manage security vulnerabilities
11.3Perform external and internal penetration testing
11.4Implement intrusion detection/prevention
11.5Deploy change detection mechanisms
11.6Detect unauthorized changes to web pages

Testing Schedule:

Test TypeFrequencyPerformed By
External vulnerability scanQuarterlyASV
Internal vulnerability scanQuarterlyInternal or external
External penetration testAnnuallyQualified tester
Internal penetration testAnnuallyQualified tester
Segmentation validationAnnually (Level 1: every 6 months)Qualified tester

Requirement 12: Security Policies​

Support information security with organizational policies and programs

Sub-RequirementDescription
12.1Information security policy is established
12.2Acceptable use policies are implemented
12.3Targeted risk analysis is performed
12.4PCI DSS responsibilities are clearly defined
12.5PCI DSS scope is documented and confirmed
12.6Security awareness education is implemented
12.7Screen personnel before hire
12.8Service provider compliance is managed
12.9Service providers acknowledge responsibilities
12.10Incident response plan is implemented

Service Provider-Specific Requirements​

Service providers (including PayFacs) have additional obligations:

RequirementService Provider Specific
3.6.1.1Additional key management for service providers
8.3.10Service provider passwords changed at least every 90 days
12.4.1Executive management quarterly PCI responsibility review
12.8.4Annual compliance status monitoring of service providers
12.9.1Service providers must provide written acknowledgment

SAQ Types​

Self-Assessment Questionnaires vary by merchant type:

SAQMerchant TypeQuestion Count
ACard-not-present, fully outsourced31
A-EPE-commerce, outsourced to validated SP42
BImprint or standalone terminals27
B-IPStandalone IP-connected terminals36
C-VTWeb-based virtual terminal28
CInternet-connected payment systems46
P2PEValidated P2PE solution33
DAll others / Service Providers251 (merchants) / 269 (SP)

Compliance Assessment Process​

Common Compliance Gaps​

RequirementCommon GapResolution
1Incomplete network diagramsDocument all CDE connections
3Storing CVV in logsMask/truncate all logging
6No script inventoryImplement CSP and monitoring
8Shared accountsEnforce unique IDs
10Incomplete loggingEnable all required log events
11Missing quarterly scansSchedule and track all scans
12Outdated policiesAnnual policy review

References​

Share: