PCI DSS: The 12 Requirements

PCI DSS Requirement 1: Firewall Configuration and Network Security

Network security controls

PCI DSS Requirement 2: Default Password and Security Parameter Management

Secure configurations

PCI DSS Requirement 3: Cardholder Data Protection and Encryption

Protecting stored data

PCI DSS Requirement 4: Encrypted Data Transmission Over Open Networks

Encryption in transit

PCI DSS Requirement 5: Anti-Virus and Anti-Malware Protection

Malware protection

PCI DSS Requirement 6: Secure System and Application Development

Secure development

PCI DSS Requirement 7: Access Control Based on Business Need-to-Know

Need-to-know access

PCI DSS Requirement 8: User Identity Management and Authentication

Identity and authentication

PCI DSS Requirement 9: Physical Access Restrictions to Cardholder Data

Physical access

PCI DSS Requirement 10: Network Resource and Cardholder Data Access Tracking

Logging and monitoring

PCI DSS Requirement 11: Regular Security System and Process Testing

Security testing

PCI DSS Requirement 12: Information Security Policy and Program Management

Policy and program management

PCI DSS Sub-Requirements Breakdown: Detailed Control Analysis

Sub-requirement detail

PCI DSS Testing Procedures: Validation Methods for Each Requirement

How each requirement is tested

PCI DSS Customized Approach: Alternative Implementation Methods

The customized approach option