Home > Services > PCI Certification

Standard

The PCI DSS (PCI Data Security Standard) defines security measures for the managing of card payments. The standard is promoted and maintained by PCI SSC (Payment Card Industry Security Standards Council), an organization launched in 2006 by the five major card payment brands – American Express, Discover, JCB, MasterCard and Visa – to enhance payment systems security.

The standard requires the adoption of a set of security requirements in 12 technical and operational intervention areas and provides that a set of periodic controls have to be performed.

Build and Maintain a Secure Network 1. Install and maintain a firewall configuration to protect cardholder data
2. Do not use vendor-supplied defaults for system passwords and other security parameters
Protect Cardholder Data 3. Protect stored cardholder data
4. Encrypt transmission of cardholder data across open, public networks
Maintain a Vulnerability Management Program 5. Use and regularly update anti-virus software on all systems commonly affected by malware
6. Develop and maintain secure systems and applications
Implement Strong Access Control Measures 7. Restrict access to cardholder data by business need-to-know
8. Assign a unique ID to each person with computer access
9. Restrict physical access to cardholder data
Regularly Monitor and Test Networks 10. Track and monitor all access to network resources and cardholder data
11. Regularly test security systems and processes
Maintain an Information Security Policy 12. Maintain a policy that addresses information security


The standard applies to all entities receiving card payments or, more generally, transmitting or storing the related PAN (Primary Account Number – the sixteen-digit number on the front of the card) such as:

  • All vendors operating physically or electronically (Merchants),
  • Banks,
  • Other parties involved in the processing of payment card data (Service Providers).

Failure to comply with the standard, besides entailing problems in terms of possible insurance claims, lawsuits etc., may be punished by payment card issuers with fines and expulsion from the transaction network.