The PCI Standard
The release of version 2.0 begins the new three year life cycle for standards development, which streamlines the development process by aligning DSS, PA-DSS and PTS on a similar three year schedule. Version 2.0 became effective on January 1, 2011 and states the following:
Build and Maintain a Secure Network
- Install and maintain a firewall configuration to protect cardholder data.
- Do not use vendor-supplied defaults for system passwords and other security parameters.
Protect Cardholder Data
- Protect stored cardholder data
- Encrypt transmission of cardholder data and sensitive information across open, public networks.
Maintain Vulnerability Management Program
- Use and regularly update anti-virus software or programs.
- Develop and maintain secure systems and applications.
Implement Strong Access Control Measures
- Restrict access to cardholder data by business need-to-know.
- Assign a unique ID to each person with computer access.
- Restrict physical access to cardholder data.
Regularly Monitor and Test Networks
- Track and monitor all access to network resources and cardholder data.
- Regularly test security systems and processes.
Maintain an Information Security Policy
- Maintain a policy that addresses information security for employees and contractors.
