PCI COMPLIANCE
CONSULTANTS

A level 1 organization processes a volume of 6 million cards or more per year.

Level 2 organizations process a transaction volume between 1 and 6 million per year.

Level 3 organizations require a transaction volume between 20, 000 and 1 million. The requirements are similar to a Level 2 organization.

Level 4 organizations have a transaction volume under 20,000. The requirements for being PCI DSS compliant are similar to Level 2 and Level 3 organizations.

In this step, standardized testing of equipment in case of a hardware or software change gets implemented. All untrusted traffic is restricted, except in cases where communication protocol is required to process payment card information. These configuration rules should be reviewed bi-annually and updated if necessary.

Default configurations are one of the most common exploits cybercriminals use. For example, most routers' default username and password is "admin". If remains unchanged, cyber-criminals can take advantage of it and gain access to an organization's network.

In case the storage is necessary, this requirement focuses on securing the stored data to prevent unauthorized usage. Organizations should limit storage and retention time to a bare minimum and perform a purge every quarter.

In case the storage is necessary, this requirement focuses on securing the stored data to prevent unauthorized usage. Organizations should limit storage and retention time to a bare minimum and perform a purge every quarter.

Organizations must ensure that AV mechanisms are deployed on all systems, use the latest directories, are always active in the systems, and generate auditable logs.

This involves installing security patches as soon as they're available. ISVs must work to ensure their clients are aware of these patches and can install them easily.

This requirement's goal is to allow only authorized access. Organizations must be able to monitor, allow, or deny access to cardholder data as requested. Unauthorized access is not only limited to criminals, a person or organization may also request information. If the information does not concern their task, that request will be considered unauthorized and thus denied.

Organizations must assign a unique ID to every authorized user with access to a PC. This way, whenever someone accesses cardholder data, the organization can trace the activity and confirm if it was accessed by an authorized user or not.

Organizations must limit parties from accessing cardholder data physically. These parties include employees, contractors, vendors, consultants, guests, etc. The access includes adding to retrieving information via systems, devices, and hard copies. On-site access control should restrict movement within the installation, keep logs of all activities, and detect unauthorized personnel. On-site security personnel can ensure enforcing these rules. Finally, all media must be removed when the business no longer needs it, or if a legal obligation surfaces.

Both wired and wireless networks connect cardholder access points. Criminals can leverage vulnerabilities in these networks to steal sensitive information. Organizations must monitor and test their network regularly to prevent these exploits. Real-time monitoring, logging, and forensic mechanisms can help with this requirement. Automated audit trails the ability to reconstruct events, and time synchronization are also required. Audit results must be secured and maintained for at least a year.

Organizations must perform quarterly tests for wireless access points that can gain unauthorized access. Internal and external scans are also required to run every quarter as well as after every significant network change. Other requirements include penetration testing, file monitoring, intrusion detection, and prevention systems.

The final requirement is dedicated to implementing and maintaining an information security policy for all employees and other relevant parties. Organizations must arrange a yearly process, which challenges the policy and makes necessary adjustments. The requirement also demands at least one agent (or at least an entire team, depending on the scope) who is responsible for these obligations.