Date: 24th September, 2018

PCI-DSS

 An acronym for Payment Card Industry-Data Security Standards

 It’s an information security standard for organizations that handle branded credit cards.
 Administered by Payment Card Industry Security Standards Council
 Current version(released in May 2018): 3.2.1
 PCI-DSS Logical Groups:
o Build and Maintain a Secure Network and Systems
o Protect Cardholder Data
o Maintain Vulnerability Management Program
o Implement Strong Access Control Measures
o Regularly Monitor and Test Networks
o Maintain an Information Security Policy
 PCI-DSS Certifications:
o Individual Level: Yes
 Qualified Security Assessor (QSA)
 Internal Security Assessor (ISA)
o Organization Level: Yes

Small to Medium sized organizations need to do following in order to satisfy the PCI-DSS
requirements.

 Complete the Self-Assessment Questionnaire (SAQ) according to the

instructions it contains.
 Complete and obtain evidence of passing vulnerability scan with a PCI SSC
Approved Scanning Vendor (ASV)