Payment Card Industry (PCI) Data Security Standard

Payment Card Industry (PCI)Data Security StandardRequirements and Security Assessment ProceduresVersion 3.2.1May 2018

Document ChangesDateOctober 2008July 2009Version1.21.2.1DescriptionPagesTo introduce PCI DSS v1.2 as “PCI DSS Requirements and Security Assessment Procedures,”eliminating redundancy between documents, and make both general and specific changes fromPCI DSS Security Audit Procedures v1.1. For complete information, see PCI Data SecurityStandard Summary of Changes from PCI DSS Version 1.1 to 1.2.Add sentence that was incorrectly deleted between PCI DSS v1.1 and v1.2.5Correct “then” to “than” in testing procedures 6.3.7.a and 6.3.7.b.32Remove grayed-out marking for “in place” and “not in place” columns in testing procedure 6.5.b.33For Compensating Controls Worksheet – Completed Example, correct wording at top of page tosay “Use this worksheet to define compensating controls for any requirement noted as ‘in place’via compensating controls.”64October 20102.0Update and implement changes from v1.2.1. See PCI DSS – Summary of Changes from PCIDSS Version 1.2.1 to 2.0.November 20133.0Update from v2.0. See PCI DSS – Summary of Changes from PCI DSS Version 2.0 to 3.0.April 20153.1Update from PCI DSS v3.0. See PCI DSS – Summary of Changes from PCI DSS Version 3.0 to3.1 for details of changes.April 20163.2Update from PCI DSS v3.1. See PCI DSS – Summary of Changes from PCI DSS Version 3.1 to3.2 for details of changes.May 20183.2.1Update from PCI DSS v3.2. See PCI DSS – Summary of Changes from PCI DSS Version 3.2 to3.2.1 for details of changes.Payment Card Industry (PCI) Data Security Standard, v3.2.1 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.Page 2May 2018

Table of ContentsDocument Changes . 2Introduction and PCI Data Security Standard Overview . 5PCI DSS Resources . 6PCI DSS Applicability Information . 7Relationship between PCI DSS and PA-DSS. 9Applicability of PCI DSS to PA-DSS Applications . 9Applicability of PCI DSS to Payment Application Vendors. 9Scope of PCI DSS Requirements . 10Network Segmentation . 11Wireless. 11Use of Third-Party Service Providers / Outsourcing . 12Best Practices for Implementing PCI DSS into Business-as-Usual Processes . 13For Assessors: Sampling of Business Facilities/System Components . 15Compensating Controls . 16Instructions and Content for Report on Compliance . 17PCI DSS Assessment Process . 17PCI DSS Versions . 18Detailed PCI DSS Requirements and Security Assessment Procedures . 19Build and Maintain a Secure Network and Systems . 20Requirement 1: Install and maintain a firewall configuration to protect cardholder data . 20Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters . 29Protect Cardholder Data . 36Requirement 3: Protect stored cardholder data . 36Requirement 4: Encrypt transmission of cardholder data across open, public networks . 47Maintain a Vulnerability Management Program . 50Requirement 5: Protect all systems against malware and regularly update anti-virus software or programs . 50Requirement 6: Develop and maintain secure systems and applications . 53Implement Strong Access Control Measures . 66Requirement 7: Restrict access to cardholder data by business need to know . 66Payment Card Industry (PCI) Data Security Standard, v3.2.1 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.Page 3May 2018

Requirement 8:Requirement 9:Identify and authenticate access to system components . 69Restrict physical access to cardholder data . 79Regularly Monitor and Test Networks . 88Requirement 10: Track and monitor all access to network resources and cardholder data . 88Requirement 11: Regularly test security systems and processes. . 96Maintain an Information Security Policy . 105Requirement 12: Maintain a policy that addresses information security for all personnel. . 105Appendix A: Additional PCI DSS Requirements . 116Appendix A1: Additional PCI DSS Requirements for Shared Hosting Providers . 117Appendix A2: Additional PCI DSS Requirements for Entities using SSL/Early TLS for Card-Present POS POI Terminal Connections . 119Appendix A3: Designated Entities Supplemental Validation (DESV) . 122Appendix B: Compensating Controls . 136Appendix C: Compensating Controls Worksheet . 137Appendix D: Segmentation and Sampling of Business Facilities/System Components . 139Payment Card Industry (PCI) Data Security Standard, v3.2.1 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.Page 4May 2018

Introduction and PCI Data Security Standard OverviewThe Payment Card Industry Data Security Standard (PCI DSS) was developed to encourage and enhance cardholder data security and facilitatethe broad adoption of consistent data security measures globally. PCI DSS provides a baseline of technical and operational requirementsdesigned to protect account data. PCI DSS applies to all entities involved in payment card processing—including merchants, processors,acquirers, issuers, and service providers. PCI DSS also applies to all other entities that store, process or transmit cardholder data (CHD) and/orsensitive authentication data (SAD). Below is a high-level overview of the 12 PCI DSS requirements.PCI Data Security Standard – High Level OverviewBuild and Maintain a SecureNetwork and SystemsProtect Cardholder DataMaintain a VulnerabilityManagement ProgramImplement Strong AccessControl Measures1.2.Install and maintain a firewall configuration to protect cardholder dataDo not use vendor-supplied defaults for system passwords and othersecurity parameters3.4.Protect stored cardholder dataEncrypt transmission of cardholder data across open, public networks5.6.Protect all systems against malware and regularly update anti-virussoftware or programsDevelop and maintain secure systems and applications7.8.9.Restrict access to cardholder data by business need to knowIdentify and authenticate access to system componentsRestrict physical access to cardholder dataRegularly Monitor and TestNetworks10.11.Track and monitor all access to network resources and cardholder dataRegularly test security systems and processesMaintain an InformationSecurity Policy12.Maintain a policy that addresses information security for all personnelThis document, PCI Data Security Standard Requirements and Security Assessment Procedures, combines the 12 PCI DSS requirements andcorresponding testing procedures into a security assessment tool. It is designed for use during PCI DSS compliance assessments as part of anentity’s validation process. The following sections provide detailed guidelines and best practices to assist entities prepare for, conduct, and reportthe results of a PCI DSS assessment. The PCI DSS Requirements and Testing Procedures begin on page 15.PCI DSS comprises a minimum set of requirements for protecting account data, and may be enhanced by additional controls and practices tofurther mitigate risks, as well as local, regional and sector laws and regulations. Additionally, legislation or regulatory requirements may requirespecific protection of personal information or other data elements (for example, cardholder name). PCI DSS does not supersede local or regionallaws, government regulations, or other legal requirements.Payment Card Industry (PCI) Data Security Standard, v3.2.1 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.Page 5May 2018

PCI DSS ResourcesThe PCI Security Standards Council (PCI SSC) website (www.pcisecuritystandards.org) contains a number of additional resources to assistorganizations with their PCI DSS assessments and validations, including: Document Library, including:oPCI DSS – Summary of Changes from PCI DSS version 2.0 to 3.0oPCI DSS Quick Reference GuideoPCI DSS and PA-DSS Glossary of Terms, Abbreviations, and AcronymsoInformation Supplements and GuidelinesoPrioritized Approach for PCI DSSoReport on Compliance (ROC) Reporting Template and Reporting InstructionsoSelf-assessment Questionnaires (SAQs) and SAQ Instructions and GuidelinesoAttestations of Compliance (AOCs) Frequently Asked Questions (FAQs) PCI for Small Merchants website PCI training courses and informational webinars List of Qualified Security Assessors (QSAs) and Approved Scanning Vendors (ASVs) List of PTS approved devices and PA-DSS validated payment applicationsNote: Information Supplementscomplement the PCI DSS and identifyadditional considerations andrecommendations for meeting PCI DSSrequirements—they do not supersede,replace or extend the PCI DSS or any of itsrequirements.Please refer to www.pcisecuritystandards.org for information about these and other resources.Payment Card Industry (PCI) Data Security Standard, v3.2.1 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.Page 6May 2018

PCI DSS Applicability InformationPCI DSS applies to all entities involved in payment card processing—including merchants, processors, acquirers, issuers, and service providers.PCI DSS also applies to all other entities that store, process, or transmit cardholder data and/or sensitive authentication data.Cardholder data and sensitive authentication data are defined as follows:Account DataCardholder Data includes: Primary Account Number (PAN) Cardholder Name Sensitive Authentication Data includes: Full track data (magnetic-stripe data orequivalent on a chip)Expiration Date CAV2/CVC2/CVV2/CIDService Code PINs/PIN blocksThe primary account number is the defining factor for cardholder data. If cardholder name, service code, and/or expiration date arestored, processed or transmitted with the PAN, or are otherwise present in the cardholder data environment (CDE), they must be protected inaccordance with applicable PCI DSS requirements.PCI DSS requirements apply to organizations where account data (cardholder data and/or sensitive authentication data) is stored, processed ortransmitted. Some PCI DSS requirements may also be applicable to organizations that have outsourced their payment operations ormanagement of their CDE. 1 Additionally, organizations that outsource their CDE or payment operations to third parties are responsible forensuring that the account data is protected by the third party per the applicable PCI DSS requirements.The table on the following page illustrates commonly used elements of cardholder and sensitive authentication data, whether storage of eachdata element is permitted or prohibited, and whether each data element must be protected. This table is not exhaustive, but is presented toillustrate the different types of requirements that apply to each data element.1In accordance with individual payment brand compliance programsPayment Card Industry (PCI) Data Security Standard, v3.2.1 2006-2018 PCI Security Standards Council, LLC. All Rights Reserved.Page 7May 2018