PCI DSS Compliance and Security

  1. The 12 Requirements of PCI DSS
    1. Requirement 1: Install and Maintain Network Security Controls
      1. Firewall Configuration Standards
        1. Configuration Documentation
          1. Change Management Procedures
            1. Review and Approval Processes
              1. Version Control
              2. Network Architecture
                1. Network Topology Documentation
                  1. DMZ Implementation
                    1. Internal Network Segmentation
                      1. Wireless Network Isolation
                      2. Traffic Control Rules
                        1. Inbound Traffic Restrictions
                          1. Outbound Traffic Controls
                            1. Default Deny Policies
                              1. Business Justification Requirements
                              2. Router Security
                                1. Router Hardening Standards
                                  1. Access Control Configuration
                                    1. Logging and Monitoring
                                      1. Firmware Management
                                      2. Personal Firewalls
                                        1. Mobile Device Requirements
                                          1. Remote Access Controls
                                            1. BYOD Policy Implementation
                                            2. Cloud and Virtualized Environments
                                              1. Virtual Firewall Configuration
                                                1. Container Security Controls
                                                  1. Cloud Security Groups
                                                2. Requirement 2: Apply Secure Configurations to All System Components
                                                  1. Configuration Standards Development
                                                    1. Baseline Security Configurations
                                                      1. Industry Best Practices Integration
                                                        1. Vendor Security Guides
                                                          1. Custom Configuration Requirements
                                                          2. System Hardening
                                                            1. Operating System Hardening
                                                              1. Database Hardening
                                                                1. Application Server Hardening
                                                                  1. Network Device Hardening
                                                                  2. Default Settings Management
                                                                    1. Default Password Changes
                                                                      1. Default Account Management
                                                                        1. Unnecessary Service Removal
                                                                          1. Sample File Removal
                                                                          2. Wireless Security
                                                                            1. Encryption Protocol Configuration
                                                                              1. Access Point Security
                                                                                1. Wireless Key Management
                                                                                  1. Guest Network Isolation
                                                                                  2. System Component Inventory
                                                                                    1. Asset Discovery Processes
                                                                                      1. Inventory Management Systems
                                                                                        1. Configuration Management Databases
                                                                                          1. Regular Inventory Updates
                                                                                          2. Vulnerability Management Integration
                                                                                            1. Configuration Vulnerability Scanning
                                                                                              1. Patch Management Coordination
                                                                                                1. Security Configuration Monitoring
                                                                                              2. Requirement 3: Protect Stored Account Data
                                                                                                1. Data Retention and Disposal
                                                                                                  1. Data Retention Policies
                                                                                                    1. Business Justification Documentation
                                                                                                      1. Secure Deletion Procedures
                                                                                                        1. Media Sanitization Standards
                                                                                                        2. Sensitive Authentication Data Prohibitions
                                                                                                          1. Full Track Data Storage Prohibition
                                                                                                            1. CAV2/CVC2/CVV2/CID Storage Prohibition
                                                                                                              1. PIN and PIN Block Storage Prohibition
                                                                                                                1. Verification and Testing Procedures
                                                                                                                2. PAN Protection Methods
                                                                                                                  1. Display Masking Requirements
                                                                                                                    1. Masking Implementation
                                                                                                                      1. Log File Protection
                                                                                                                        1. Report Generation Controls
                                                                                                                        2. Cryptographic Protection
                                                                                                                          1. Encryption Standards
                                                                                                                            1. Key Management Requirements
                                                                                                                              1. Tokenization Implementation
                                                                                                                                1. Hashing Methods
                                                                                                                                2. Cryptographic Key Management
                                                                                                                                  1. Key Generation Procedures
                                                                                                                                    1. Key Distribution Methods
                                                                                                                                      1. Key Storage Requirements
                                                                                                                                        1. Key Rotation Policies
                                                                                                                                          1. Key Destruction Procedures
                                                                                                                                            1. Key Recovery Processes
                                                                                                                                            2. Database Security
                                                                                                                                              1. Database Encryption
                                                                                                                                                1. Access Controls
                                                                                                                                                  1. Database Activity Monitoring
                                                                                                                                                    1. Backup Protection
                                                                                                                                                  2. Requirement 4: Protect Cardholder Data with Strong Cryptography During Transmission
                                                                                                                                                    1. Encryption in Transit
                                                                                                                                                      1. TLS Configuration Requirements
                                                                                                                                                        1. Certificate Management
                                                                                                                                                          1. Cipher Suite Selection
                                                                                                                                                            1. Protocol Version Management
                                                                                                                                                            2. Wireless Transmission Security
                                                                                                                                                              1. Wireless Encryption Standards
                                                                                                                                                                1. WPA3 Implementation
                                                                                                                                                                  1. Wireless Key Management
                                                                                                                                                                    1. Wireless Network Monitoring
                                                                                                                                                                    2. End-User Messaging Restrictions
                                                                                                                                                                      1. Email Transmission Prohibitions
                                                                                                                                                                        1. Instant Messaging Controls
                                                                                                                                                                          1. Chat Application Restrictions
                                                                                                                                                                            1. SMS/Text Message Policies
                                                                                                                                                                            2. Public Network Considerations
                                                                                                                                                                              1. Internet Transmission Security
                                                                                                                                                                                1. VPN Requirements
                                                                                                                                                                                  1. Public Wi-Fi Restrictions
                                                                                                                                                                                    1. Mobile Network Security
                                                                                                                                                                                    2. Legacy Protocol Management
                                                                                                                                                                                      1. SSL Deprecation
                                                                                                                                                                                        1. Early TLS Versions
                                                                                                                                                                                          1. Migration Planning
                                                                                                                                                                                            1. Exception Management
                                                                                                                                                                                          2. Requirement 5: Protect All Systems and Networks from Malicious Software
                                                                                                                                                                                            1. Anti-Malware Solution Deployment
                                                                                                                                                                                              1. Endpoint Protection Systems
                                                                                                                                                                                                1. Server Protection
                                                                                                                                                                                                  1. Gateway Protection
                                                                                                                                                                                                    1. Email Security
                                                                                                                                                                                                    2. Anti-Malware Management
                                                                                                                                                                                                      1. Centralized Management Platforms
                                                                                                                                                                                                        1. Signature Updates
                                                                                                                                                                                                          1. Engine Updates
                                                                                                                                                                                                            1. Policy Management
                                                                                                                                                                                                            2. Scanning and Detection
                                                                                                                                                                                                              1. Real-Time Scanning
                                                                                                                                                                                                                1. Scheduled Scans
                                                                                                                                                                                                                  1. On-Demand Scans
                                                                                                                                                                                                                    1. Behavioral Analysis
                                                                                                                                                                                                                    2. Incident Response Integration
                                                                                                                                                                                                                      1. Malware Detection Alerts
                                                                                                                                                                                                                        1. Quarantine Procedures
                                                                                                                                                                                                                          1. Remediation Processes
                                                                                                                                                                                                                            1. Reporting Requirements
                                                                                                                                                                                                                            2. Alternative Protection Methods
                                                                                                                                                                                                                              1. Application Whitelisting
                                                                                                                                                                                                                                1. Behavioral Monitoring
                                                                                                                                                                                                                                  1. Sandboxing Technologies
                                                                                                                                                                                                                                    1. Network-Based Protection
                                                                                                                                                                                                                                  2. Requirement 6: Develop and Maintain Secure Systems and Software
                                                                                                                                                                                                                                    1. Secure Software Development Lifecycle
                                                                                                                                                                                                                                      1. SDLC Framework Implementation
                                                                                                                                                                                                                                        1. Security Requirements Integration
                                                                                                                                                                                                                                          1. Threat Modeling
                                                                                                                                                                                                                                            1. Security Architecture Review
                                                                                                                                                                                                                                            2. Vulnerability Management
                                                                                                                                                                                                                                              1. Vulnerability Identification
                                                                                                                                                                                                                                                1. Risk Assessment Procedures
                                                                                                                                                                                                                                                  1. Remediation Prioritization
                                                                                                                                                                                                                                                    1. Patch Management Integration
                                                                                                                                                                                                                                                    2. Software Development Security
                                                                                                                                                                                                                                                      1. Secure Coding Standards
                                                                                                                                                                                                                                                        1. Code Review Processes
                                                                                                                                                                                                                                                          1. Static Application Security Testing
                                                                                                                                                                                                                                                            1. Dynamic Application Security Testing
                                                                                                                                                                                                                                                            2. Change Control Procedures
                                                                                                                                                                                                                                                              1. Change Request Management
                                                                                                                                                                                                                                                                1. Impact Assessment
                                                                                                                                                                                                                                                                  1. Testing Requirements
                                                                                                                                                                                                                                                                    1. Approval Workflows
                                                                                                                                                                                                                                                                      1. Deployment Procedures
                                                                                                                                                                                                                                                                      2. Web Application Security
                                                                                                                                                                                                                                                                        1. OWASP Top 10 Mitigation
                                                                                                                                                                                                                                                                          1. Web Application Firewalls
                                                                                                                                                                                                                                                                            1. Input Validation
                                                                                                                                                                                                                                                                              1. Output Encoding
                                                                                                                                                                                                                                                                                1. Session Management
                                                                                                                                                                                                                                                                                2. Third-Party Software Management
                                                                                                                                                                                                                                                                                  1. Vendor Assessment
                                                                                                                                                                                                                                                                                    1. Software Inventory
                                                                                                                                                                                                                                                                                      1. Update Management
                                                                                                                                                                                                                                                                                        1. End-of-Life Planning
                                                                                                                                                                                                                                                                                      2. Requirement 7: Restrict Access to System Components and Cardholder Data by Business Need to Know
                                                                                                                                                                                                                                                                                        1. Access Control Principles
                                                                                                                                                                                                                                                                                          1. Principle of Least Privilege
                                                                                                                                                                                                                                                                                            1. Need-to-Know Basis
                                                                                                                                                                                                                                                                                              1. Separation of Duties
                                                                                                                                                                                                                                                                                                1. Defense in Depth
                                                                                                                                                                                                                                                                                                2. Role-Based Access Control
                                                                                                                                                                                                                                                                                                  1. Role Definition and Documentation
                                                                                                                                                                                                                                                                                                    1. Role Assignment Procedures
                                                                                                                                                                                                                                                                                                      1. Role Review Processes
                                                                                                                                                                                                                                                                                                        1. Role Modification Controls
                                                                                                                                                                                                                                                                                                        2. Access Rights Management
                                                                                                                                                                                                                                                                                                          1. Access Request Procedures
                                                                                                                                                                                                                                                                                                            1. Approval Workflows
                                                                                                                                                                                                                                                                                                              1. Access Provisioning
                                                                                                                                                                                                                                                                                                                1. Access Review and Recertification
                                                                                                                                                                                                                                                                                                                2. Privileged Access Management
                                                                                                                                                                                                                                                                                                                  1. Administrative Account Controls
                                                                                                                                                                                                                                                                                                                    1. Privileged Session Management
                                                                                                                                                                                                                                                                                                                      1. Just-in-Time Access
                                                                                                                                                                                                                                                                                                                        1. Privileged Account Monitoring
                                                                                                                                                                                                                                                                                                                        2. Data Classification
                                                                                                                                                                                                                                                                                                                          1. Data Sensitivity Levels
                                                                                                                                                                                                                                                                                                                            1. Access Control Matrices
                                                                                                                                                                                                                                                                                                                              1. Data Handling Procedures
                                                                                                                                                                                                                                                                                                                                1. Classification Review Processes
                                                                                                                                                                                                                                                                                                                              2. Requirement 8: Identify Users and Authenticate Access to System Components
                                                                                                                                                                                                                                                                                                                                1. User Identification
                                                                                                                                                                                                                                                                                                                                  1. Unique User IDs
                                                                                                                                                                                                                                                                                                                                    1. Account Naming Conventions
                                                                                                                                                                                                                                                                                                                                      1. Shared Account Restrictions
                                                                                                                                                                                                                                                                                                                                        1. Generic Account Management
                                                                                                                                                                                                                                                                                                                                        2. Authentication Methods
                                                                                                                                                                                                                                                                                                                                          1. Password-Based Authentication
                                                                                                                                                                                                                                                                                                                                            1. Multi-Factor Authentication
                                                                                                                                                                                                                                                                                                                                              1. Biometric Authentication
                                                                                                                                                                                                                                                                                                                                                1. Certificate-Based Authentication
                                                                                                                                                                                                                                                                                                                                                2. Password Management
                                                                                                                                                                                                                                                                                                                                                  1. Password Complexity Requirements
                                                                                                                                                                                                                                                                                                                                                    1. Password Length Standards
                                                                                                                                                                                                                                                                                                                                                      1. Password Expiration Policies
                                                                                                                                                                                                                                                                                                                                                        1. Password History Requirements
                                                                                                                                                                                                                                                                                                                                                          1. Password Storage Protection
                                                                                                                                                                                                                                                                                                                                                          2. Multi-Factor Authentication Implementation
                                                                                                                                                                                                                                                                                                                                                            1. MFA for Remote Access
                                                                                                                                                                                                                                                                                                                                                              1. MFA for Administrative Access
                                                                                                                                                                                                                                                                                                                                                                1. MFA for CDE Access
                                                                                                                                                                                                                                                                                                                                                                  1. MFA Technology Options
                                                                                                                                                                                                                                                                                                                                                                  2. Account Management
                                                                                                                                                                                                                                                                                                                                                                    1. Account Provisioning
                                                                                                                                                                                                                                                                                                                                                                      1. Account Modification
                                                                                                                                                                                                                                                                                                                                                                        1. Account Deprovisioning
                                                                                                                                                                                                                                                                                                                                                                          1. Account Monitoring
                                                                                                                                                                                                                                                                                                                                                                          2. Service Account Management
                                                                                                                                                                                                                                                                                                                                                                            1. Service Account Inventory
                                                                                                                                                                                                                                                                                                                                                                              1. Service Account Security
                                                                                                                                                                                                                                                                                                                                                                                1. Service Account Monitoring
                                                                                                                                                                                                                                                                                                                                                                                  1. Service Account Review
                                                                                                                                                                                                                                                                                                                                                                                2. Requirement 9: Restrict Physical Access to Cardholder Data
                                                                                                                                                                                                                                                                                                                                                                                  1. Physical Access Controls
                                                                                                                                                                                                                                                                                                                                                                                    1. Facility Entry Controls
                                                                                                                                                                                                                                                                                                                                                                                      1. Badge Access Systems
                                                                                                                                                                                                                                                                                                                                                                                        1. Biometric Access Controls
                                                                                                                                                                                                                                                                                                                                                                                          1. Mantrap Implementation
                                                                                                                                                                                                                                                                                                                                                                                          2. Visitor Management
                                                                                                                                                                                                                                                                                                                                                                                            1. Visitor Registration
                                                                                                                                                                                                                                                                                                                                                                                              1. Escort Requirements
                                                                                                                                                                                                                                                                                                                                                                                                1. Visitor Badge Systems
                                                                                                                                                                                                                                                                                                                                                                                                  1. Access Logging
                                                                                                                                                                                                                                                                                                                                                                                                  2. Physical Media Controls
                                                                                                                                                                                                                                                                                                                                                                                                    1. Media Storage Security
                                                                                                                                                                                                                                                                                                                                                                                                      1. Media Transport Procedures
                                                                                                                                                                                                                                                                                                                                                                                                        1. Media Access Controls
                                                                                                                                                                                                                                                                                                                                                                                                          1. Media Inventory Management
                                                                                                                                                                                                                                                                                                                                                                                                          2. Media Destruction
                                                                                                                                                                                                                                                                                                                                                                                                            1. Destruction Procedures
                                                                                                                                                                                                                                                                                                                                                                                                              1. Destruction Documentation
                                                                                                                                                                                                                                                                                                                                                                                                                1. Destruction Verification
                                                                                                                                                                                                                                                                                                                                                                                                                  1. Third-Party Destruction Services
                                                                                                                                                                                                                                                                                                                                                                                                                  2. Point-of-Sale Device Security
                                                                                                                                                                                                                                                                                                                                                                                                                    1. Device Inventory Management
                                                                                                                                                                                                                                                                                                                                                                                                                      1. Device Inspection Procedures
                                                                                                                                                                                                                                                                                                                                                                                                                        1. Tamper Detection
                                                                                                                                                                                                                                                                                                                                                                                                                          1. Device Replacement Procedures
                                                                                                                                                                                                                                                                                                                                                                                                                          2. Surveillance Systems
                                                                                                                                                                                                                                                                                                                                                                                                                            1. Camera Placement
                                                                                                                                                                                                                                                                                                                                                                                                                              1. Recording Requirements
                                                                                                                                                                                                                                                                                                                                                                                                                                1. Footage Retention
                                                                                                                                                                                                                                                                                                                                                                                                                                  1. Access to Surveillance Data
                                                                                                                                                                                                                                                                                                                                                                                                                                2. Requirement 10: Log and Monitor All Access to System Components and Cardholder Data
                                                                                                                                                                                                                                                                                                                                                                                                                                  1. Logging Requirements
                                                                                                                                                                                                                                                                                                                                                                                                                                    1. Events to Log
                                                                                                                                                                                                                                                                                                                                                                                                                                      1. Log Content Requirements
                                                                                                                                                                                                                                                                                                                                                                                                                                        1. Log Format Standards
                                                                                                                                                                                                                                                                                                                                                                                                                                          1. Log Completeness
                                                                                                                                                                                                                                                                                                                                                                                                                                          2. Log Management Infrastructure
                                                                                                                                                                                                                                                                                                                                                                                                                                            1. Centralized Logging
                                                                                                                                                                                                                                                                                                                                                                                                                                              1. Log Collection Methods
                                                                                                                                                                                                                                                                                                                                                                                                                                                1. Log Storage Requirements
                                                                                                                                                                                                                                                                                                                                                                                                                                                  1. Log Backup Procedures
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2. Time Synchronization
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1. NTP Configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1. Time Source Management
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1. Time Accuracy Requirements
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1. Time Zone Considerations
                                                                                                                                                                                                                                                                                                                                                                                                                                                          2. Log Review and Analysis
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1. Daily Log Review Procedures
                                                                                                                                                                                                                                                                                                                                                                                                                                                              1. Automated Log Analysis
                                                                                                                                                                                                                                                                                                                                                                                                                                                                1. Exception Handling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1. Alert Management
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2. Log Protection
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1. Log Access Controls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1. Log Integrity Protection
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1. Log Retention Requirements
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1. Log Archival Procedures
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2. Security Information and Event Management (SIEM)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1. SIEM Implementation
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1. Correlation Rules
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1. Alerting Configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1. Incident Response Integration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2. Requirement 11: Test Security of Systems and Networks Regularly
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1. Vulnerability Scanning
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1. Internal Vulnerability Scans
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1. External Vulnerability Scans
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1. Authenticated vs Unauthenticated Scans
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1. Scan Frequency Requirements
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2. Approved Scanning Vendor (ASV) Program
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1. ASV Selection Criteria
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1. ASV Scan Process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1. Scan Report Review
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1. Remediation Requirements
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2. Penetration Testing
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1. Internal Penetration Testing
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1. External Penetration Testing
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1. Testing Methodologies
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1. Tester Qualifications
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2. Wireless Security Testing
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1. Wireless Access Point Detection
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1. Rogue Access Point Identification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1. Wireless Security Assessment
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1. Wireless Monitoring Tools
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2. Intrusion Detection and Prevention
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1. IDS/IPS Deployment
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1. Signature Management
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1. Alert Tuning
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1. Response Procedures
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2. File Integrity Monitoring
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1. Critical File Identification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1. Change Detection Methods
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1. Alert Generation
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1. Change Analysis Procedures
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2. Security Testing Integration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1. Testing Schedule Coordination
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1. Results Correlation
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1. Remediation Tracking
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1. Continuous Monitoring
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2. Requirement 12: Support Information Security with Organizational Policies and Programs
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1. Information Security Policy Framework
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1. Policy Development Process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1. Policy Approval Procedures
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1. Policy Communication
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1. Policy Review and Updates
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2. Risk Management Program
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1. Risk Assessment Methodology
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1. Risk Identification Procedures
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1. Risk Analysis and Evaluation
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1. Risk Treatment Planning
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1. Risk Monitoring and Review
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2. Security Awareness and Training
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1. Training Program Development
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1. Training Content Requirements
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1. Training Delivery Methods
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1. Training Effectiveness Measurement
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2. Incident Response Program
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1. Incident Response Plan
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1. Incident Classification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1. Response Team Structure
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1. Communication Procedures
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1. Evidence Handling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1. Post-Incident Activities
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2. Service Provider Management
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1. Due Diligence Procedures
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1. Contract Requirements
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1. Ongoing Monitoring
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1. Performance Management
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2. Business Continuity Planning
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1. Business Impact Analysis
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1. Recovery Strategies
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1. Plan Testing
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1. Plan Maintenance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Previous

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3. Scoping for PCI DSS Compliance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Go to top

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Next

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5. Validation and Assessment Methods