PCI DSS Archives - Devendrakumar Shirbad

Additional Requirements

In this post, we will list and understand additional PCI DSS requirements for different types of entities.

The organization’s overall information security policy sets the tone for the whole entity and informs personnel what is expected of them.

System components, processes, and bespoke and custom software should be tested frequently to ensure security controls continue to reflect.

Log mechanisms and the ability to track user activities are critical in preventing, detecting, or minimizing the impact of a data compromise.

Any physical access to cardholder data or systems that store, process, or transmit cardholder data provides the opportunity to criminals.

These requirements for identity and authentication are based on industry-accepted security principles and best practices.

Without a mechanism to restrict access based on a user’s need to know, a user may unknowingly be granted access to cardholder data.

For custom software, numerous vulnerabilities can be avoided by applying software lifecycle (SLC) processes and secure coding techniques.

Malicious software (malware) is software or firmware designed to infiltrate or damage a computer system without the owner’s knowledge.

To protect against compromise, PAN must be encrypted during transmission over networks, including untrusted and public networks.