PCI DSS

PIC DSS

Standards for securing cardholder data and reducing credit card fraud risks.

Showing 252 controls

PCI-2542 Anti-virus Software or Programs (5)

Anti-virus Capabilities (5.1.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2566 Anti-virus Software or Programs (5)

Disabling Anti-virus (5.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2595 Anti-virus Software or Programs (5)

Deploy Anti-virus Software (5.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2602 Anti-virus Software or Programs (5)

Evaluating Systems Not Commonly Affected By Malicious Software (5.1.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2627 Anti-virus Software or Programs (5)

Policies and Procedures for Protecting Against Malware (5.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2650 Anti-virus Software or Programs (5)

Anti-virus Maintenance (5.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2497 Encryption of Cardholder Data (4)

Policies and Procedures for Encrypting Transmissions of Cardholder Data (4.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2498 Encryption of Cardholder Data (4)

Use of Strong Cryptography and Security Protocols (4.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2535 Encryption of Cardholder Data (4)

Transmission of Unprotected PANs By End-user Messaging Technologies (4.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2673 Encryption of Cardholder Data (4)

Wireless Networks Transmitting Cardholder Data (4.1.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2482 Firewall Configurations (1)

Firewall and Router Configuration Standards (1.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2514 Firewall Configurations (1)

Segregate Cardholder Data Environment on Internal Network Zone (1.3.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2527 Firewall Configurations (1)

Documentation of All Services, Protocols, and Ports Allowed (1.1.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2538 Firewall Configurations (1)

Restricting Inbound and Outbound Traffic (1.2.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2539 Firewall Configurations (1)

Cardholder data Flows Diagram (1.1.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2579 Firewall Configurations (1)

Firewall Network Requirements (1.1.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2592 Firewall Configurations (1)

Limiting DMZ InBound Traffic (1.3.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2600 Firewall Configurations (1)

Restricting Public Internet Access (1.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2607 Firewall Configurations (1)

Formal Firewall and Router Configurations Process (1.1.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2611 Firewall Configurations (1)

Securing and Synchronizing Router Configuration Files (1.2.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2631 Firewall Configurations (1)

Restricting Traffic Between the Internet and the Cardholder Data Environment (1.3.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2646 Firewall Configurations (1)

Documenting Security Policies and Firewall Management (1.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2655 Firewall Configurations (1)

Firewall and Router Configurations For Untrusted Networks (1.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2656 Firewall Configurations (1)

Perimeter Firewalls Between Wireless Networks and Cardholder Data Environment (1.2.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2665 Firewall Configurations (1)

Implementing a DMZ to Limit Inbound Traffic (1.3.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2666 Firewall Configurations (1)

Permit only established connections into the network (1.3.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2674 Firewall Configurations (1)

Current Network Diagram (1.1.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2676 Firewall Configurations (1)

Installing Personal Firewall Software on Mobile Devices (1.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2686 Firewall Configurations (1)

Disclosure of Private IPs and Routing Information (1.3.7)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2687 Firewall Configurations (1)

Six Month Firewall and Router Reviews (1.1.7)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2696 Firewall Configurations (1)

Implementing Anti-spoofing Measures (1.3.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2702 Firewall Configurations (1)

Preventing the Disclosure of Private IP Addresses and Routing Information to Unauthorized Parties (1.3.8)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2704 Firewall Configurations (1)

Roles and Responsibilities for Managing Network Components (1.1.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2473 ID Management (8)

MFA for remote access (8.3.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2480 ID Management (8)

Verifying User Identities (8.2.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2484 ID Management (8)

Use of Group, Shared, or Generic Authentication Methods (8.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2496 ID Management (8)

User Authentication Management (8.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2502 ID Management (8)

Unique User IDs (8.1.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2515 ID Management (8)

Lockout Duration (8.1.7)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2519 ID Management (8)

MFA for non-console access to CDE (8.3.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2521 ID Management (8)

User ID Management (8.1.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2522 ID Management (8)

Documenting and Communicating Authentication Policies and Procedures (8.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2550 ID Management (8)

Use of Other Authentication Mechanisms (8.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2551 ID Management (8)

Session Time Out (8.1.8)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2571 ID Management (8)

Service Providers with Remote Access (8.5.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2577 ID Management (8)

Password Requirements (8.2.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2598 ID Management (8)

Incorporating Multi-factor Authentication (8.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2599 ID Management (8)

Policies and Procedures for User Identification Management (8.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2603 ID Management (8)

Passwords Change Schedule (8.2.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2619 ID Management (8)

Revoking Access for Terminated Users (8.1.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2626 ID Management (8)

Passwords Issued / Reset Requirements (8.2.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2633 ID Management (8)

Cryptography (8.2.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2638 ID Management (8)

Limiting Access Attempts (8.1.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2648 ID Management (8)

Policies and Procedures (8.8)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2663 ID Management (8)

Reusing Old Passwords (8.2.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2672 ID Management (8)

Vendor ID Management (8.1.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2697 ID Management (8)

Removing/disabling Inactive User Accounts (8.1.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2720 ID Management (8)

Access to Databases Containing Cardholder Data (8.7)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2478 Information Security Policy (12)

Maintaining a List of Service Providers (12.8.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2483 Information Security Policy (12)

Staff Training for Breach Response (12.10.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2489 Information Security Policy (12)

Written Acknowledgement of Service Provider Responsibility (12.9)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2494 Information Security Policy (12)

List of Authorized Usage of Devices (12.3.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2499 Information Security Policy (12)

Information Security Responsibilities (12.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2505 Information Security Policy (12)

Administering User Accounts (12.5.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2506 Information Security Policy (12)

Additional Requirement for Service Providers Only: Executive Management Responsibility for Protecting Cardholder Data and PCI DSS Compliance (12.4.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2509 Information Security Policy (12)

Verifying Personnel Understands Security Policies and Procedures (12.6.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2512 Information Security Policy (12)

Incident Response Plan (12.10)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2526 Information Security Policy (12)

Policy Reviews and Updates (12.1.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2533 Information Security Policy (12)

Managing PCI DSS Requirements by Service Providers (12.8.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2537 Information Security Policy (12)

Usage Approvals By Authorized Parties (12.3.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2552 Information Security Policy (12)

List of Company-approved Products (12.3.7)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2553 Information Security Policy (12)

Process for Engaging Service Providers (12.8.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2554 Information Security Policy (12)

Usage Policies (12.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2559 Information Security Policy (12)

Establish, Publish, Maintain, and Disseminate a Security Policy (12.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2563 Information Security Policy (12)

Acceptable Uses of Technology (12.3.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2567 Information Security Policy (12)

Incorporating Lessons Learned and Industry Developments (12.10.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2586 Information Security Policy (12)

Activation of Remote-access Technologies for Vendors and Business Partners (12.3.9)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2588 Information Security Policy (12)

Managing Service Providers (12.8)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2590 Information Security Policy (12)

Personnel Education (12.6.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2596 Information Security Policy (12)

Establish, Document, and Distribute Security Policies and Procedures (12.5.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2620 Information Security Policy (12)

Monitoring and Controlling All Access to Data (12.5.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2621 Information Security Policy (12)

Risk-assessment Process (12.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2634 Information Security Policy (12)

Security Awareness Program (12.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2637 Information Security Policy (12)

Service Provider Responsibility Agreements (12.8.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2640 Information Security Policy (12)

Monitoring Service Provider Compliance (12.8.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2642 Information Security Policy (12)

Plan Testing (12.10.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2647 Information Security Policy (12)

Quarterly Reviews (12.11)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2651 Information Security Policy (12)

Accessing Cardholder Data Via Remote-access Technologies (12.3.10)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2658 Information Security Policy (12)

Assigning Information Security Management Responsibilities (12.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2667 Information Security Policy (12)

New Hire Screening (12.7)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2671 Information Security Policy (12)

Monitoring and Analyzing Security Alerts and Information (12.5.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2675 Information Security Policy (12)

Inventorying of Devices (12.3.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2680 Information Security Policy (12)

Incident Response Plan Components (12.10.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2681 Information Security Policy (12)

Automatic Remote-access Disconnect (12.3.8)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2683 Information Security Policy (12)

Acceptable Network Locations of Technologies (12.3.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2693 Information Security Policy (12)

Availability of Personnel to Respond to Alerts (12.10.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2705 Information Security Policy (12)

Authentication For Use of Technology (12.3.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2709 Information Security Policy (12)

Incident Response and Escalation Procedures (12.5.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2710 Information Security Policy (12)

Alerts From Security Monitoring Systems (12.10.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2716 Information Security Policy (12)

Documentation of Quarterly Review Process (12.11.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2476 Physical Access to Cardholder Data (9)

Onsite Personnel and Visitors (9.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2492 Physical Access to Cardholder Data (9)

Protecting Payment Card Devices (9.9)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2500 Physical Access to Cardholder Data (9)

Maintaining Up-to-date Device Lists (9.9.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2517 Physical Access to Cardholder Data (9)

Retrieving Visitor Badges (9.4.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2523 Physical Access to Cardholder Data (9)

Visitor Logs (9.4.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2524 Physical Access to Cardholder Data (9)

Media Destruction (9.8)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2529 Physical Access to Cardholder Data (9)

Media Delivery Approvals (9.6.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2530 Physical Access to Cardholder Data (9)

Control Over the Distribution of Media (9.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2546 Physical Access to Cardholder Data (9)

Inspection of Device Surfaces (9.9.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2557 Physical Access to Cardholder Data (9)

Media Storage and Accessibility (9.7)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2561 Physical Access to Cardholder Data (9)

Access to Publicly Accessible Network Jacks (9.1.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2574 Physical Access to Cardholder Data (9)

Hard-copy Data Destruction (9.8.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2584 Physical Access to Cardholder Data (9)

Physical Access to Wireless Access Points, Gateways, Handheld Devices, Networking/communications Hardware, and Telecommunication Lines (9.1.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2597 Physical Access to Cardholder Data (9)

Policies and Procedures (9.10)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2608 Physical Access to Cardholder Data (9)

Media Inventory Logs (9.7.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2615 Physical Access to Cardholder Data (9)

Storing Media Backups (9.5.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2623 Physical Access to Cardholder Data (9)

Employee Training (9.9.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2624 Physical Access to Cardholder Data (9)

Physically Securing Media (9.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2628 Physical Access to Cardholder Data (9)

Media Delivery (9.6.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2645 Physical Access to Cardholder Data (9)

Issuing Visitor Badges (9.4.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2659 Physical Access to Cardholder Data (9)

Facility Entry Controls (9.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2669 Physical Access to Cardholder Data (9)

Media Classification (9.6.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2678 Physical Access to Cardholder Data (9)

Electronic Media Protection (9.8.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2688 Physical Access to Cardholder Data (9)

Monitoring Physical Access (9.1.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2694 Physical Access to Cardholder Data (9)

Visitor Escorting (9.4.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2695 Physical Access to Cardholder Data (9)

Visitor Identification and Authorization (9.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2715 Physical Access to Cardholder Data (9)

Access For Onsite Personnel to Sensitive Areas (9.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2474 Protecting Stored Cardholder Data (3)

Prevention of Unauthorized Substitution of Cryptographic Keys (3.6.7)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2487 Protecting Stored Cardholder Data (3)

Securing Cryptographic Key Distribution (3.6.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2488 Protecting Stored Cardholder Data (3)

Cryptographic Key Changes (3.6.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2490 Protecting Stored Cardholder Data (3)

Clear-text Cryptographic Key Management (3.6.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2510 Protecting Stored Cardholder Data (3)

Securing Cryptographic Key Storage (3.6.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2518 Protecting Stored Cardholder Data (3)

Storing of Card Verification Codes (3.2.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2534 Protecting Stored Cardholder Data (3)

Access and Authentication with Disk Encryption (3.4.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2536 Protecting Stored Cardholder Data (3)

Restricting Access to Cryptographic Keys (3.5.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2543 Protecting Stored Cardholder Data (3)

Restricting PAN (3.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2569 Protecting Stored Cardholder Data (3)

Storing Sensitive Authentication Data After Authorization (3.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2570 Protecting Stored Cardholder Data (3)

Storing Cryptographic Keys in the Fewest Possible Locations (3.5.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2578 Protecting Stored Cardholder Data (3)

Minimizing Cardholder Data Storage (3.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2580 Protecting Stored Cardholder Data (3)

Security Policies and Operational Procedures (3.7)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2587 Protecting Stored Cardholder Data (3)

Generation of Strong Cryptographic Keys (3.6.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2636 Protecting Stored Cardholder Data (3)

Document and Implement Key Management Processes and Procedures (3.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2649 Protecting Stored Cardholder Data (3)

Storing the Personal Identification Number (PIN) (3.2.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2689 Protecting Stored Cardholder Data (3)

Storing Keys Used to Encrypt / Decrypt Cardholder Data (3.5.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2690 Protecting Stored Cardholder Data (3)

Key-custodian Responsibilities (3.6.8)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2700 Protecting Stored Cardholder Data (3)

Retirement or Replacement of Keys (3.6.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2708 Protecting Stored Cardholder Data (3)

Managing PAN Data Storage (3.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2722 Protecting Stored Cardholder Data (3)

Maintain a Description of the Cryptographic Architecture (3.5.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2723 Protecting Stored Cardholder Data (3)

Protecting Keys Used in Storing Cardholder Data (3.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2540 Restricting Access to Cardholder Data (7)

Job classifications and functions (7.1.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2575 Restricting Access to Cardholder Data (7)

Least Privilege Access (7.1.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2618 Restricting Access to Cardholder Data (7)

Coverage of All System Components (7.2.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2625 Restricting Access to Cardholder Data (7)

Limiting Access to Cardholder Data (7.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2630 Restricting Access to Cardholder Data (7)

Assignment of Privileges (7.2.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2677 Restricting Access to Cardholder Data (7)

Access Control System Restrictions (7.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2692 Restricting Access to Cardholder Data (7)

Default deny-all Setting (7.2.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2703 Restricting Access to Cardholder Data (7)

Documented Privileges Approval (7.1.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2713 Restricting Access to Cardholder Data (7)

Policies & Procedures (7.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2721 Restricting Access to Cardholder Data (7)

Defining Access Needs (7.1.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2501 Securing Systems and Applications (6)

Production Data for Development (6.4.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2507 Securing Systems and Applications (6)

Public-facing Web Applications (6.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2532 Securing Systems and Applications (6)

Improper Access Control (6.5.8)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2541 Securing Systems and Applications (6)

Broken Authentication and Session Management (6.5.10)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2547 Securing Systems and Applications (6)

Addressing Coding Vulnerabilities (6.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2549 Securing Systems and Applications (6)

Improper Error Handling (6.5.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2556 Securing Systems and Applications (6)

Separating Development/test Environments From Production Environments (6.4.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2562 Securing Systems and Applications (6)

Removal of Test Data and Accounts (6.4.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2565 Securing Systems and Applications (6)

Installing Critical Security Patches (6.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2568 Securing Systems and Applications (6)

Policies and Procedures (6.7)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2572 Securing Systems and Applications (6)

Functionality Testing (6.4.5.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2585 Securing Systems and Applications (6)

Buffer Overflows (6.5.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2594 Securing Systems and Applications (6)

Injection Flaws (6.5.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2601 Securing Systems and Applications (6)

Documentation of Impact (6.4.5.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2604 Securing Systems and Applications (6)

Security of Custom Application Accounts (6.3.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2605 Securing Systems and Applications (6)

Developing Internal and External Software Applications (6.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2606 Securing Systems and Applications (6)

Insecure Cryptographic Storage (6.5.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2622 Securing Systems and Applications (6)

Documented Change Approval (6.4.5.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2639 Securing Systems and Applications (6)

Back-out Procedures (6.4.5.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2643 Securing Systems and Applications (6)

Change Control Procedures for Security Patches and Software Modifications (6.4.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2652 Securing Systems and Applications (6)

Change Control Processes and Procedures (6.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2661 Securing Systems and Applications (6)

Cross-site Request Forgery (CSRF) (6.5.9)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2682 Securing Systems and Applications (6)

Cross-site Scripting (XSS) (6.5.7)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2699 Securing Systems and Applications (6)

Significant Changes (6.4.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2706 Securing Systems and Applications (6)

Separating Duties Between Development/test and Production Environments (6.4.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2711 Securing Systems and Applications (6)

Establishing a Process to Assess and Identify Security Vulnerabilities (6.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2717 Securing Systems and Applications (6)

Insecure Communications (6.5.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2719 Securing Systems and Applications (6)

Addressing High Risk Vulnerabilities (6.5.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2724 Securing Systems and Applications (6)

Reviewing of Custom Code Prior to Release (6.3.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2481 System Defaults Management (2)

Security Policies and Procedures for Managing Vendor Defaults (2.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2486 System Defaults Management (2)

Encrypting Non-console Administrative Access (2.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2513 System Defaults Management (2)

Implementing Additional Security Features (2.2.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2516 System Defaults Management (2)

Maintaining an Inventory of System Components (2.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2520 System Defaults Management (2)

Changing Vendor-supplied Defaults (2.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2525 System Defaults Management (2)

Protection Within Shared Hosting Providers (2.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2591 System Defaults Management (2)

Removing Unnecessary Functionality (2.2.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2609 System Defaults Management (2)

Implementing One Primary Function Per Server (2.2.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2612 System Defaults Management (2)

Changing Vendor Defaults in Wireless Environments (2.1.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2653 System Defaults Management (2)

Developing Configuration Standards for All System Components (2.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2660 System Defaults Management (2)

Enabling Only Necessary Services (2.2.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2684 System Defaults Management (2)

Configuring System Security Parameters to Prevent Misuse (2.2.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2479 Testing Security Systems and Processes (11)

Scanning Due to Significant Change (11.2.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2485 Testing Security Systems and Processes (11)

Responding to Change-detection Alerts (11.5.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2491 Testing Security Systems and Processes (11)

Intrusion-detection/intrusion-prevention (11.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2495 Testing Security Systems and Processes (11)

Correcting Exploitable Vulnerabilities (11.3.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2503 Testing Security Systems and Processes (11)

Policies and Procedures (11.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2504 Testing Security Systems and Processes (11)

Change-detection Alerts (11.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2531 Testing Security Systems and Processes (11)

External Penetration Testing (11.3.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2544 Testing Security Systems and Processes (11)

Testing Wireless Access Points (11.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2582 Testing Security Systems and Processes (11)

External Vulnerability Scanning (11.2.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2589 Testing Security Systems and Processes (11)

Internal Vulnerability Scanning (11.2.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2593 Testing Security Systems and Processes (11)

Testing Changes to Segmentation Controls (service providers only) (11.3.4.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2613 Testing Security Systems and Processes (11)

Internal Penetration Testing (11.3.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2617 Testing Security Systems and Processes (11)

CDE Segmentation (11.3.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2629 Testing Security Systems and Processes (11)

Penetration Testing Methodology (11.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2641 Testing Security Systems and Processes (11)

Inventory of Authorized Wireless Access Points (11.1.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2701 Testing Security Systems and Processes (11)

Vulnerability Scanning (11.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2712 Testing Security Systems and Processes (11)

Incident Response Procedures (11.1.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2475 Tracking and Monitoring Network Access and Data (10)

Protection of Audit Trail Files (10.5.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2493 Tracking and Monitoring Network Access and Data (10)

Name of Affected Data, System Component, or Resource is Logged (10.3.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2508 Tracking and Monitoring Network Access and Data (10)

Exceptions and Anomalies Are Identified and Addressed (10.6.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2511 Tracking and Monitoring Network Access and Data (10)

File-integrity Monitoring On Logs (10.5.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2528 Tracking and Monitoring Network Access and Data (10)

Reviewing of Log Data to Identify Anomalies or Auspicious Activity (10.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2545 Tracking and Monitoring Network Access and Data (10)

Daily Log Reviews (10.6.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2548 Tracking and Monitoring Network Access and Data (10)

Date and Time is Logged (10.3.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2555 Tracking and Monitoring Network Access and Data (10)

Logging Audit Trails (10.2.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2558 Tracking and Monitoring Network Access and Data (10)

Audit Trail History (10.7)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2560 Tracking and Monitoring Network Access and Data (10)

Type of Event is Logged (10.3.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2564 Tracking and Monitoring Network Access and Data (10)

Logging Identification and Authentication Mechanisms (10.2.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2573 Tracking and Monitoring Network Access and Data (10)

Policies and Procedures (10.9)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2576 Tracking and Monitoring Network Access and Data (10)

Record Audit Trail Entries For All System Components (10.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2581 Tracking and Monitoring Network Access and Data (10)

Audit Trails Are Secured (10.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2583 Tracking and Monitoring Network Access and Data (10)

Logging the Creation and Deletion of System-level Objects (10.2.7)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2610 Tracking and Monitoring Network Access and Data (10)

Origination of Event is Logged (10.3.5)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2614 Tracking and Monitoring Network Access and Data (10)

Viewing of Audit Trails (10.5.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2616 Tracking and Monitoring Network Access and Data (10)

User Identification is Logged (10.3.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2632 Tracking and Monitoring Network Access and Data (10)

Success or Failure Indication is Logged (10.3.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2635 Tracking and Monitoring Network Access and Data (10)

Time Settings Are From Industry-accepted Time Sources (10.4.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2644 Tracking and Monitoring Network Access and Data (10)

Implementing Audit Trails (10.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2654 Tracking and Monitoring Network Access and Data (10)

Logging User Access to Cardholder Data (10.2.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2657 Tracking and Monitoring Network Access and Data (10)

Critical Systems Have the Correct and Consistent Time (10.4.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2662 Tracking and Monitoring Network Access and Data (10)

Audit Trail Files Back-up (10.5.3)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2664 Tracking and Monitoring Network Access and Data (10)

Synchronization of All Critical System Clocks and Times (10.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2668 Tracking and Monitoring Network Access and Data (10)

Logging Invalid Logical Access Attempts (10.2.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2670 Tracking and Monitoring Network Access and Data (10)

Logs for External-facing Technologies (10.5.4)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2679 Tracking and Monitoring Network Access and Data (10)

Time Data is Protected (10.4.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2685 Tracking and Monitoring Network Access and Data (10)

Logging the Initialization, Stoppage or Pausing of Audit Logs (10.2.6)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2691 Tracking and Monitoring Network Access and Data (10)

Implementing Automated Audit Trails for All System Components (10.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2698 Tracking and Monitoring Network Access and Data (10)

Response to Failures (service providers only) (10.8.1)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2707 Tracking and Monitoring Network Access and Data (10)

Logging Root or Administrative Privilege Actions (10.2.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2714 Tracking and Monitoring Network Access and Data (10)

Log Reviews of Other Systems (10.6.2)

The goal is to ensure that appropriate safeguards are in place and effective.

PCI-2718 Tracking and Monitoring Network Access and Data (10)

Detection of Failures (service providers only) (10.8)

The goal is to ensure that appropriate safeguards are in place and effective.

12.3.1 whois

Change-control processes and procedures are followed for all changes to system components.

All domain and DNS changes are processed via formal change control with logging and rollback procedures.