Payment Card (PCI-DSS)

The PCI (Payment Card Industry) Security Standards Council works to enhance the security of payment account data. The PCI’s Data Security Standard (DSS) dictates detailed security and auditing requirements for council members.

PCSentry can help you demonstrate compliance with many PCI-DSS requirements, including:

  • 2.2.b Verify that system configuration standards are updated as new vulnerability issues are identified, as defined in Requirement 6.2.
  • 5.1 Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers).
  • 5.1.1 Ensure that all anti-virus programs are capable of detecting, removing, and protecting against all known types of malicious software.
  • 5.2 Ensure that all anti-virus mechanisms are current, actively running, and generating audit logs.
  • 6.1 Ensure that all system components and software have the latest vendor-supplied security patches installed. Install critical security patches within one month of release.
  • 6.2 Establish a process to identify newly discovered security vulnerabilities (for example, subscribe to alert services freely available on the Internet). Update configuration standards as required by PCI DSS Requirement 2.2 to address new vulnerability issues.
  • 10.6 Review logs for all system components at least daily. Log reviews must include those servers that perform security functions like intrusion-detection system (IDS) and authentication, authorization, and accounting protocol (AAA) servers (for example, RADIUS).
  • 11.2.1 Perform quarterly internal vulnerability scans.
  • 11.2.3 Perform internal and external scans after any significant change.