PCI Compliance Basic Template

Description

Here you can download a basic template that will cover for your PCI (Payment Card Industry) needs.

All 12 PCI DSS  requirement sections are included. You will have to download and modify for your own needs. But this will give you a leg up on the requirement to create and maintain a security policy

Several Q&A sessions are included (at least 2)

 

Build and Maintain a Secure Network and Systems

1. Install and maintain a firewall configuration to protect cardholder data.
   • Firewalls control incoming and outgoing network traffic and help prevent unauthorized access.
2. Do not use vendor-supplied defaults for system passwords and other security parameters.
   • Default credentials (e.g., admin/admin) are easily exploited by attackers—use strong, unique credentials.

---

Protect Cardholder Data

3. Protect stored cardholder data.
   • Encrypt, tokenize, or mask sensitive data when storing it. Retain only necessary data for as long as required.

4. Encrypt transmission of cardholder data across open, public networks.
   • Use strong encryption protocols (e.g., TLS) to protect data in transit over public networks.

---

Maintain a Vulnerability Management Program

5. Protect all systems against malware and regularly update anti-virus software or programs.
   • Install and maintain anti-malware solutions on all systems and ensure they receive regular updates.

6. Develop and maintain secure systems and applications.
   • Regularly apply security patches and updates to fix vulnerabilities in software and hardware.

---

Implement Strong Access Control Measures

7. Restrict access to cardholder data by business need-to-know.
   • Only grant access to individuals who require it to perform their job responsibilities.

8. Identify and authenticate access to system components.
   • Implement strong authentication mechanisms, such as multi-factor authentication, for all user access.

9. Restrict physical access to cardholder data.
   • Protect physical environments where cardholder data is stored (e.g., server rooms) from unauthorized access.

---

Regularly Monitor and Test Networks

10. Track and monitor all access to network resources and cardholder data.
    • Maintain detailed logs of system access and monitor for suspicious activities.

11. Regularly test security systems and processes.
    • Conduct vulnerability scans, penetration testing, and other assessments to identify and address weaknesses.

---

Maintain an Information Security Policy

12. Maintain a policy that addresses information security for all personnel.
    • Establish and enforce a robust security policy that includes training and awareness for employees.