PCI-DSS Compliance Checklist

Establish and maintain firewall and router configuration standards

• Document all network connections and data flows
• Define firewall rules and review regularly
• Maintain network diagrams

Restrict connections between untrusted networks and the cardholder data environment

• Configure firewalls to deny all by default
• Document business justification for allowed protocols
• Implement stateful inspection

Prohibit direct public access between the internet and systems storing cardholder data

• Use DMZ architecture
• Never expose databases to the internet
• Implement network segmentation

Always change vendor defaults before installing a system on the network

• Change all default passwords
• Remove unnecessary default accounts
• Disable unnecessary services

Develop configuration standards for all system components

• Create hardening standards
• Document secure configurations
• Enable only necessary services

Encrypt all non-console administrative access using strong cryptography

• Use SSH, VPN, or TLS
• Disable Telnet, HTTP
• Implement strong cipher suites

Keep cardholder data storage to a minimum

• Document data retention policy
• Purge data after retention
• Store only necessary data

Do not store sensitive authentication data after authorization

• Never store full track data
• Never store CVV/CVC codes
• Never store PIN blocks

First 6 and last 4 digits maximum

• Display only last 4 digits
• Implement role-based access
• Mask PAN in logs

Render PAN unreadable anywhere it is stored

• Use strong cryptography
• Implement truncation or tokenization
• Use one-way hashes

During transmission over open, public networks

• Use TLS 1.2 or higher
• Verify certificates
• Use only secure cipher suites

Never send unencrypted PANs by end-user messaging technologies

• Never email card numbers
• Prohibit PANs via SMS or chat
• Train staff

On all systems commonly affected by malware

• Install antivirus on Windows systems
• Keep definitions current
• Evaluate other systems

Active, maintained, and monitored

• Enable automatic updates
• Perform periodic scans
• Generate audit logs

Processes are in place to identify security vulnerabilities

• Use reputable vulnerability sources
• Assign risk rankings
• Install critical patches within 30 days

Bespoke and custom software is developed securely

• Train developers in secure coding
• Follow OWASP guidelines
• Review custom code

Public-facing web apps are protected against attacks

• Use a WAF
• Conduct security assessments
• Address OWASP Top 10

Restrict access to system components

• Define access needs per role
• Restrict to minimum necessary
• Document access levels

Access is appropriately defined and assigned

• Use RBAC
• Default deny
• Review access regularly

Identification and authentication processes managed

• Unique ID per user
• Manage credentials
• Remove inactive accounts

Strictly managed

• MFA for admin access
• Strong password policies
• Lock after failed attempts

Established for users and admins

• MFA for all remote access
• MFA for non-console CDE
• Protect against replay attacks

Physical access control processes

• Limit physical access to CDE
• Use access control mechanisms
• Escort visitors

Manage entry into facilities and sensitive areas

• Use video cameras
• Protect against tampering
• Log physical access

Securely managed

• Classify media
• Securely send/receive
• Destroy when not needed

Logging access processes defined

• Log all CHD access
• Log admin actions
• Log auth attempts

Support detection of anomalies

• Record user identification
• Type of event and date/time
• Success/failure indication

From destruction and unauthorized modifications

• Restrict log access
• Use integrity monitoring
• Backup logs to central server

Reviewed to identify anomalies

• Daily review of critical events
• Review all components
• Follow up on exceptions

Identify and test for wireless access points

• Test for unauthorized wireless quarterly
• Maintain inventory
• Respond to unauthorized wireless

Internal and external vulnerabilities identified and addressed

• Quarterly internal scans
• Quarterly external ASV scans
• Rescan until passing

External and internal penetration testing performed

• Annual pen testing
• Network and app layers
• Address findings and retest

IDS/IPS used

• IDS/IPS at perimeter
• Monitor all CDE traffic
• Keep signatures up to date

Comprehensive policy established and maintained

• Establish and publish
• Review at least annually
• Define roles and responsibilities

Acceptable use and risk assessment processes

• Annual risk assessments
• Define acceptable use
• Identify and classify assets

Education provided to all personnel

• Train upon hire
• Train at least annually
• Require acknowledgment

Established and tested

• Create plan
• Test annually
• 24/7 response personnel