Sign In
Explore
AWS
Azure
GCP
Information Security Policy
PCI Assessment
Risk Assessment
SOC 2 Audit
Audit
Start A Scan
Information Security Policy Review
PCI Report Analysis
Risk Assessment Review
SOC 2 Report Analysis
Learn
Contact
Pricing
Sign In
PCI v4.0 - 9.4.1, 9.4.1.1, & 9.4.1.2: Media with Cardholder Data Is Physically Secured
Related Videos
Areas to Include in an Incident Response Cybersecurity Policy
Copy Link
Assigning Information Security Management Responsibility
Copy Link
Choice of Words in Professional Cybersecurity Documents
Copy Link
Components to Include in Your Cybersecurity Program
Copy Link
Create Policies for Usage of Critical Technologies
Copy Link
Creating a Data Flow Diagram
Copy Link
Creating a Network Diagram
Copy Link
Define Staff Information Security Responsibilities in Policy
Copy Link
Define a Password Reset Procedure to Authenticate Requests
Copy Link
Define the Boundaries of Your Systems
Copy Link
Distribute Policies to Affected Parties
Copy Link
Do You Have to Do PCI?
Copy Link
Document Cybersecurity Programs with Certificates
Copy Link
Document Your Configuration Management Practices
Copy Link
Document Your Data Protection Processes in a Media Protection Policy
Copy Link
Document the Why Behind Your Processes in Cybersecurity Policies
Copy Link
Encrypted Cardholder Data and Scope
Copy Link
Establish Policy to Disconnect Remote Sessions
Copy Link
Establish a Policy to Manage Your Service Providers
Copy Link
Getting Started with PCI Compliance
Copy Link
Honesty to Achieve Compliance
Copy Link
How Do You Scope a PCI DSS Assessment?
Copy Link
How To Build Workforce Awareness Around Incident Response
Copy Link
How To Govern the Use of Mobile Devices
Copy Link
How to Avoid a Smart Contract Flaw
Copy Link
How to Create a Physical Security Policy
Copy Link
How to Create an Access Control Policy
Copy Link
How to Disseminate an Information Security Policy
Copy Link
How to Document Identification and Authentication Controls Within Your Security Policies
Copy Link
How to Evaluate the Maturity of Your Security Awareness Training
Copy Link
How to Manage Cybersecurity Liability
Copy Link
How to Manage a Security Policy in Turbulent Times
Copy Link
How to Negotiate Cybersecurity Contracts
Copy Link
How to Prevent Insider Threats with Secure Personnel Processes
Copy Link
How to Write and Manage a Security Procedure
Copy Link
Identify and Mitigate Risk with a Risk Assessment Policy
Copy Link
Identifying a Person's Identity for Data Protection
Copy Link
Implement Procedures to Secure Your Mobile Devices
Copy Link
Improve Your Security Policy With FBI CJIS
Copy Link
Limiting PCI DSS Scope
Copy Link
Maintain Logs for Audit Accountability
Copy Link
PCI Compliance One Step at a Time
Copy Link
PCI DSS Assessment Scope: Identify All Other People Processes and Technology
Copy Link
PCI DSS Assessment Scope: Identify Cardholder Data Flows
Copy Link
PCI DSS Assessment Scope: Identify People and Processes
Copy Link
PCI DSS Assessment Scope: Identify Technology
Copy Link
PCI DSS Assessment Scope: Identify Third Parties
Copy Link
PCI Requirement 10.9 – Document Policies & Procedures for Monitoring Access to Network Resources
Copy Link
PCI Requirement 11.6 – Ensure Security Policies for Security Monitoring are Documented
Copy Link
PCI Requirement 12- Maintain a Policy that Addresses Information Security for All Personnel
Copy Link
PCI Requirement 12.1 & 12.1.1 – Establish, Publish, Maintain, and Disseminate a Security Policy
Copy Link
PCI Requirement 12.3 – Develop Usage Policies for Critical Technologies
Copy Link
PCI Requirement 12.3.1 – Explicit Approval by Authorized Parties
Copy Link
PCI Requirement 12.3.10 – Prohibit the Moving of Cardholder Data onto Local Hard Drives
Copy Link
PCI Requirement 12.3.2 – Authentication for Use of the Technology
Copy Link
PCI Requirement 12.3.3 – A List of All Such Devices and Personnel with Access
Copy Link
PCI Requirement 12.3.4 – A Method to Accurately Determine Owner, Contact Information, and Purpose
Copy Link
PCI Requirement 12.3.5 – Acceptable Uses of the Technology
Copy Link
PCI Requirement 12.3.6 – Acceptable Network Locations for the Technologies
Copy Link
PCI Requirement 12.3.7 – List of Company-Approved Products
Copy Link
PCI Requirement 12.4 – Ensure Security Policies & Procedures Define Responsibilities for All
Copy Link
PCI Requirement 12.5 – Assign Information Security Management Responsibilities to a Team
Copy Link
PCI Requirement 12.5.1 – Establish, Document, and Distribute Security Policies and Procedures
Copy Link
PCI Requirement 12.6.2 – Require Personnel to Read and Understand Security Policies and Procedures
Copy Link
PCI Requirement 5.4 – Ensure Security Policies and Procedures are Known to all Affected Parties
Copy Link
PCI Requirement 6.7 – Ensure Policies & Procedures for Systems Are Documented, in Use & Known
Copy Link
PCI Requirement 9.10 – Ensure Policies for Restricting Physical Access to Cardholder Data are Known
Copy Link
PCI Requirement 9.4.1 – Visitors are Authorized Before Entering, and Escorted at all Times
Copy Link
PCI v3.2.1 vs. PCI 4.0: What's Changed?
Copy Link
PCI v4.0 - 1.1.1: Requirement 1 Policies and Procedures Are In Place
Copy Link
PCI v4.0 - 1.1.2: Requirement 1 Roles and Responsibilities Are In Place
Copy Link
PCI v4.0 - 1.2.1: Configuration Standards for Network Security Controls Are Implemented
Copy Link
PCI v4.0 - 1.2.2: Changes to Network Connections and Security Controls Are Approved
Copy Link
PCI v4.0 - 1.2.3: Maintain an Accurate Network Diagram
Copy Link
PCI v4.0 - 1.2.4: Maintain an Accurate Data-Flow Diagram
Copy Link
PCI v4.0 - 1.2.5: All Services Protocols and Ports Are Identified and Approved
Copy Link
PCI v4.0 - 1.2.6: Security Features Are Implemented on All Services Protocols and Ports
Copy Link
PCI v4.0 - 1.2.7: Network Security Controls Configurations Are Reviewed Regularly
Copy Link
PCI v4.0 - 1.2.8: Keep Configuration Files for Network Security Controls Secure and Consistent
Copy Link
PCI v4.0 - 1.3.1: Inbound Cardholder Data Environment Traffic Is Restricted
Copy Link
PCI v4.0 - 1.3.2: Outbound Traffic from the Cardholder Data Environment Is Restricted
Copy Link
PCI v4.0 - 1.3.3: Implement a Network Security Control Between Wireless Network and Wired CDE Segments
Copy Link
PCI v4.0 - 1.4.1: Network Security Controls Are Installed Between Trusted and Untrusted Networks
Copy Link
PCI v4.0 - 1.4.2: Inbound Traffic From Untrusted to Trusted Networks Is Restricted
Copy Link
PCI v4.0 - 1.4.3: Anti-Spoofing Measures Are In Place
Copy Link
PCI v4.0 - 1.4.4: Ensure Stored Cardholder Data Is Not Accessible from Untrusted Networks
Copy Link
PCI v4.0 - 1.4.5: Internal IP Addresses And Routing Information Is Only Disclosed to Authorized Parties
Copy Link
PCI v4.0 - 1.5.1: Security Controls Are Implemented on Any Computing Devices
Copy Link
PCI v4.0 - 10.1.1: Requirement 10 Policies and Procedures Are In Place
Copy Link
PCI v4.0 - 10.1.2: Requirement 10 Roles and Responsibilities Are In Place
Copy Link
PCI v4.0 - 10.2.1.1: Logs Capture Individual User Access to Cardholder Data
Copy Link
PCI v4.0 - 10.2.1.2: Logs Capture All Actions by Someone with Administrative Access
Copy Link
PCI v4.0 - 10.2.1.3: Logs Capture All Access to Audit Logs
Copy Link
PCI v4.0 - 10.2.1.4: Logs Capture All Invalid Logical Access Attempts
Copy Link
PCI v4.0 - 10.2.1.5: Logs Capture All Changes to Identification and Authentication Credentials
Copy Link
PCI v4.0 - 10.2.1.6: Logs Capture All Initialization Starting Stopping and Pausing of Audit Logs
Copy Link
PCI v4.0 - 10.2.1.7: Logs Capture All Creation and Deletion of System Level Objects
Copy Link
PCI v4.0 - 10.2.1: Audit Logs Are Enabled and Active
Copy Link
PCI v4.0 - 10.2.2: Audit Logs Record All Appropriate Information for Each Auditable Event
Copy Link
PCI v4.0 - 10.3.1: Read Access to Audit Log Files Is Limited
Copy Link
PCI v4.0 - 10.3.2: Audit Log Files Are Protected from Modification
Copy Link
PCI v4.0 - 10.3.3: Audit Log Files Are Properly Backed Up
Copy Link
PCI v4.0 - 10.3.4: Utilize File Integrity Monitoring or Change-Detection Tools on Audit Logs
Copy Link
PCI v4.0 - 10.4.1 & 10.4.1.1: Perform Specific Daily Audit Log Reviews Using Automated Mechanisms
Copy Link
PCI v4.0 - 10.4.2 & 10.4.2.1: Periodically Perform Other Audit Log Reviews
Copy Link
PCI v4.0 - 10.4.3: Address Identified Exceptions and Anomalies
Copy Link
PCI v4.0 - 10.5.1: Retain Audit Log History for At Least 12 Months
Copy Link
PCI v4.0 - 10.6.1: System Clocks and Time Are Synchronized
Copy Link
PCI v4.0 - 10.6.2: Systems Are Configured to the Correct and Consistent Time
Copy Link
PCI v4.0 - 10.6.3: Time Synchronization Settings and Data Are Protected
Copy Link
PCI v4.0 - 10.7.1: (Service Providers) Critical Security Control System Failures Are Addressed
Copy Link
PCI v4.0 - 10.7.2: Failure of Critical Security Control Systems Are Handled Appropriately
Copy Link
PCI v4.0 - 10.7.3: Failure of Any Critical Security Controls Are Promptly Addressed
Copy Link
PCI v4.0 - 11.1.1: Requirement 11 Polices and Procedures Are In Place
Copy Link
PCI v4.0 - 11.1.2: Requirement 11 Roles and Responsibilities Are In Place
Copy Link
PCI v4.0 - 11.2.1: Wireless Access Points Are Properly Managed
Copy Link
PCI v4.0 - 11.2.2: Maintain Inventory of All Authorized Wireless Access Points
Copy Link
PCI v4.0 - 11.3.1.1: Manage Non-High Risk and Non-Critical Vulnerabilities Appropriately
Copy Link
PCI v4.0 - 11.3.1.2: Use Authenticated Vulnerability Scanning Tools for Internal Scans
Copy Link
PCI v4.0 - 11.3.1.3: Perform Internal Scans After Significant Changes
Copy Link
PCI v4.0 - 11.3.1: Perform Internal Vulnerability Scans Frequently
Copy Link
PCI v4.0 - 11.3.2.1: Perform External Scans After Significant Changes
Copy Link
PCI v4.0 - 11.3.2: Perform External Vulnerability Scans Frequently
Copy Link
PCI v4.0 - 11.4.1: Define Document and Implement a Penetration Testing Methodology
Copy Link
PCI v4.0 - 11.4.2: Regularly Perform Internal Penetration Testing
Copy Link
PCI v4.0 - 11.4.3: Regularly Perform External Penetration Testing
Copy Link
PCI v4.0 - 11.4.4: Correct Vulnerabilities Found in Penetration Testing
Copy Link
PCI v4.0 - 11.4.5 & 11.4.6: Test the Effectiveness of Segmentation Controls Regularly
Copy Link
PCI v4.0 - 11.4.7: Multi-Tenant Service Providers Support Customers for External Penetration Testing
Copy Link
PCI v4.0 - 11.5.1.1: Detect Alert and Address Covert Malware Communication Channels
Copy Link
PCI v4.0 - 11.5.1: Implement Intrusion Detection and or Prevention Techniques
Copy Link
PCI v4.0 - 11.5.2: Deploy a Change-Detection Mechanism
Copy Link
PCI v4.0 - 11.6.1: Change-Detection or Tamper-Detection Mechanisms Are Deployed on Payment Pages
Copy Link
PCI v4.0 - 12.1.1: Have and Utilize an Information Security Policy
Copy Link
PCI v4.0 - 12.1.2: Review and Update Your Information Security Policy Regularly
Copy Link
PCI v4.0 - 12.1.3: Ensure Your Information Security Policy Defines Roles and Responsibilities
Copy Link
PCI v4.0 - 12.1.4: Formally Assign Information Security Responsibility to a CISO
Copy Link
PCI v4.0 - 12.10.1: Establish a Comprehensive Incident Response Plan
Copy Link
PCI v4.0 - 12.10.2: Regularly Review the Incident Response Plan
Copy Link
PCI v4.0 - 12.10.3: Ensure Specific Security Personnel Are Available for Incident Response
Copy Link
PCI v4.0 - 12.10.4.1: Utilize the Targeted Risk Analysis to Determine Incident Response Training Frequency
Copy Link
PCI v4.0 - 12.10.4: Appropriately Train Incident Response Personnel
Copy Link
PCI v4.0 - 12.10.5: Include Monitoring and Responding to Alerts in the Incident Response Plan
Copy Link
PCI v4.0 - 12.10.6: Modify the Incident Response Plan as Needed
Copy Link
PCI v4.0 - 12.10.7: Implement Incident Response Procedures Upon Detection of Stored Primary Account Numbers
Copy Link
PCI v4.0 - 12.2.1: Acceptable Use Policies Are Documented and Implemented
Copy Link
PCI v4.0 - 12.3.1: Use Targeted Risk Analyses to Support Flexible Testing
Copy Link
PCI v4.0 - 12.3.2: Perform Targeted Risk Analyses for Customized Approach
Copy Link
PCI v4.0 - 12.3.3: Document and Review Cryptographic Cipher Suites and Protocols in Use
Copy Link
PCI v4.0 - 12.3.4: Review Software and Hardware Technologies
Copy Link
PCI v4.0 - 12.4.1: Service Providers Must Establish Protections for Card Holder Data
Copy Link
PCI v4.0 - 12.4.2.1: Document the Reviews Performed in Requirement 12.4.2
Copy Link
PCI v4.0 - 12.4.2: Ensure Personnel Are Performing Their Duties
Copy Link
PCI v4.0 - 12.5.1: Maintain an Inventory of System Components That Are in Scope
Copy Link
PCI v4.0 - 12.5.2.1: Service Providers Must Document and Confirm Scope Frequently
Copy Link
PCI v4.0 - 12.5.2: Document and Confirm Scope Regularly
Copy Link
PCI v4.0 - 12.5.3: Review Scope After Significant Changes to Organizational Structure
Copy Link
PCI v4.0 - 12.6.1: Implement Formal Security Awareness Training
Copy Link
PCI v4.0 - 12.6.2: Review Your Information Security Awareness Program Regularly
Copy Link
PCI v4.0 - 12.6.3.1: Include Specific Threats and Vulnerabilities in Information Security Awareness Trainings
Copy Link
PCI v4.0 - 12.6.3.2: Include Acceptable Use Policies in Security Awareness Trainings
Copy Link
PCI v4.0 - 12.6.3: Hold Information Security Awareness Trainings Regularly
Copy Link
PCI v4.0 - 12.7.1: Screen Personnel Who Have Access to the Cardholder Data Environment
Copy Link
PCI v4.0 - 12.8.1: Keep Record of Third-Party Service Providers that Account Data Is Shared With
Copy Link
PCI v4.0 - 12.8.2: Maintain Written Requirements with Third-Party Service Providers
Copy Link
PCI v4.0 - 12.8.3: Establish a Process for Engaging with Third-Party Service Providers
Copy Link
PCI v4.0 - 12.8.4: Monitor the PCI DSS Compliance of Third-Party Service Providers
Copy Link
PCI v4.0 - 12.8.5: Detail Responsibilities Held by Third-Party Service Providers
Copy Link
PCI v4.0 - 12.9.1: Acknowledge Account Security Responsibilities
Copy Link
PCI v4.0 - 12.9.2: Provide Compliance Information to Clients Upon Request
Copy Link
PCI v4.0 - 2.1.1: Requirement 2 Policies and Procedures Are In Place
Copy Link
PCI v4.0 - 2.1.2: Requirement 2 Roles and Responsibilities Are In Place
Copy Link
PCI v4.0 - 2.2.1: Configuration Standards Are Developed Implemented and Maintained
Copy Link
PCI v4.0 - 2.2.2: Vendor Default Accounts Are Managed Properly
Copy Link
PCI v4.0 - 2.2.3: Primary Functions Requiring Different Security Levels Are Managed
Copy Link
PCI v4.0 - 2.2.4: Unnecessary Functionalities Are Removed or Disabled
Copy Link
PCI v4.0 - 2.2.5: Insecure Daemons Protocols and Services Have Additional Security Features
Copy Link
PCI v4.0 - 2.2.6: System Security Parameters Are Configured to Prevent Misuse
Copy Link
PCI v4.0 - 2.2.7: Non-Console Administrative Access Is Encrypted
Copy Link
PCI v4.0 - 2.3.1: Wireless Vendor Defaults Are Changed or Confirmed to Be Secure
Copy Link
PCI v4.0 - 2.3.2: Wireless Encryption Keys Are Changed Accordingly
Copy Link
PCI v4.0 - 3.1.1 & 3.1.2: Have Requirement 3 Policies and Procedures Assigned and In Place
Copy Link
PCI v4.0 - 3.2.1: Only Retain the Minimum Account Data Needed
Copy Link
PCI v4.0 - 3.3.1, 3.3.1.1, 3.3.1.2, & 3.3.1.3: Do Not Retain Any Sensitive Authentication Data
Copy Link
PCI v4.0 - 3.3.2: Encrypt Sensitive Authentication Data If Retained for Any Length of TIme
Copy Link
PCI v4.0 - 3.3.3: (Issuers Only) Store Only the Minimum Amount of Sensitive Authentication Data Needed
Copy Link
PCI v4.0 - 3.4.1: Mask Displayed Primary Account Number
Copy Link
PCI v4.0 - 3.4.2: Do Not Allow Primary Account Numbers to Be Copied When Using Remote Access
Copy Link
PCI v4.0 - 3.5.1.1: Ensure All Hashes Are Keyed
Copy Link
PCI v4.0 - 3.5.1.2: Correctly Utilize Disk-Level Encryption of Primary Account Numbers
Copy Link
PCI v4.0 - 3.5.1.3: Ensure Disk-Level Encryption Meets Requirements
Copy Link
PCI v4.0 - 3.5.1: Store Primary Account Numbers Appropriately
Copy Link
PCI v4.0 - 3.6.1.1: (Service Providers) Document and Describe the Cryptographic Architecture
Copy Link
PCI v4.0 - 3.6.1.3 & 3.6.1.4: Use Fewest Possible Custodians and Locations for Cryptographic Keys
Copy Link
PCI v4.0 - 3.6.1: Use Fewest Possible Number of Key Custodians Locations and Forms
Copy Link
PCI v4.0 - 3.7.1: Utilize Procedures to Generate Strong Cryptographic Keys
Copy Link
PCI v4.0 - 3.7.2 & 3.7.3: Implement Policies and Procedures to Safely Distribute and Store Keys
Copy Link
PCI v4.0 - 3.7.4: Define Cryptoperiods in Policies and Procedures for Key Management
Copy Link
PCI v4.0 - 3.7.5: Properly Retire Replace or Destroy Keys When Appropriate
Copy Link
PCI v4.0 - 3.7.6: Use Split Knowledge and Dual Control for Manual Cleartext Key Management
Copy Link
PCI v4.0 - 3.7.7: Do Not Allow Unauthorized Key Substitution
Copy Link
PCI v4.0 - 3.7.8: Require Key Custodians to Acknowledge and Accept Their Responsibilities
Copy Link
PCI v4.0 - 4.1.1 & 4.1.2: Have Requirement 4 Policies and Procedures Assigned and In Place
Copy Link
PCI v4.0 - 4.2.1.1: Maintain Inventory of Trusted Keys and Certificates
Copy Link
PCI v4.0 - 4.2.1.2: Utilize Strong Cryptography When Transmitting Primary Account Numbers on Wireless Networks
Copy Link
PCI v4.0 - 4.2.1: Properly Secure Primary Account Numbers During Transmission
Copy Link
PCI v4.0 - 4.2.2: Secure Primary Account Numbers When Transmitting via End User Messaging
Copy Link
PCI v4.0 - 5.1.1: Have Requirement 5 Policies and Procedures In Place
Copy Link
PCI v4.0 - 5.1.2: Have Requirement 5 Roles and Responsibilities In Place
Copy Link
PCI v4.0 - 5.2.1: Deploy Anti-Malware Solutions on All System Components
Copy Link
PCI v4.0 - 5.2.2: Utilize Sufficient Anti-Malware Solutions
Copy Link
PCI v4.0 - 5.2.3.1: Define Frequency of Periodic Evaluations of Systems in the Targeted Risk Analysis
Copy Link
PCI v4.0 - 5.2.3: Periodically Review Systems Not Protected by Anti-Malware Solutions
Copy Link
PCI v4.0 - 5.3.1: Keep Anti-Malware Solutions Up to Date
Copy Link
PCI v4.0 - 5.3.2.1: Define Frequency of Anti-Malware Scans in Targeted Risk Analysis
Copy Link
PCI v4.0 - 5.3.2: Ensure Anti-Malware Solution Performs Scans or Continuous Behavior Analyses
Copy Link
PCI v4.0 - 5.3.3: Utilize Anti-Malware Solutions for Removable Media
Copy Link
PCI v4.0 - 5.3.4: Enable and Retain Audit Logs for Anti-Malware Solutions
Copy Link
PCI v4.0 - 5.3.5: Do Not Allow Anti-Malware Solutions to Be Altered or Disabled
Copy Link
PCI v4.0 - 5.4.1: Have Protections in Place to Prevent Phishing Attacks
Copy Link
PCI v4.0 - 6.1.1: Requirement 6 Policies and Procedures Are In Place
Copy Link
PCI v4.0 - 6.1.2: Requirement 6 Roles and Responsibilities Are In Place
Copy Link
PCI v4.0 - 6.2.1: Bespoke and Custom Software Are Developed Securely
Copy Link
PCI v4.0 - 6.2.2: Train Personnel Developing Custom Software in Secure Software Practices
Copy Link
PCI v4.0 - 6.2.3 & 6.2.3.1: Bespoke and Custom Software Is Reviewed Before Being Released
Copy Link
PCI v4.0 - 6.2.4: Utilize Software Engineering Techniques to Secure Bespoke and Custom Software
Copy Link
PCI v4.0 - 6.3.1: Identify Security Vulnerabilities in Software
Copy Link
PCI v4.0 - 6.3.2: Maintain a List of Bespoke and Custom and Third-Party Software
Copy Link
PCI v4.0 - 6.3.3: Remediate Known Vulnerabilities Through Security Patches
Copy Link
PCI v4.0 - 6.4.1: Protect Public-Facing Web Applications
Copy Link
PCI v4.0 - 6.4.2: Use an Automated Solution to Protect Public-Facing Web Applications
Copy Link
PCI v4.0 - 6.4.3: Payment Page Scripts Are Managed Properly
Copy Link
PCI v4.0 - 6.5.1: Have a Documented Change Process for All System Components
Copy Link
PCI v4.0 - 6.5.2: Ensure Applicable PCI DSS Requirements Are In Place After Significant Changes
Copy Link
PCI v4.0 - 6.5.3: Pre-Production and Production Environments Are Separated
Copy Link
PCI v4.0 - 6.5.4: Separate Duties Between Production and Pre-Production Environments
Copy Link
PCI v4.0 - 6.5.5: Live Primary Account Numbers Are Not Used In Pre-Production Environments
Copy Link
PCI v4.0 - 6.5.6: Ensure Test Data and Accounts Are Removed Before Going into Production
Copy Link
PCI v4.0 - 7.1.1: Have Requirement 7 Policies and Procedures In Place
Copy Link
PCI v4.0 - 7.1.2: Have Requirement 7 Roles and Responsibilities In Place
Copy Link
PCI v4.0 - 7.2.1: Have an Access Control Model In Place
Copy Link
PCI v4.0 - 7.2.2: Grant Access Appropriately
Copy Link
PCI v4.0 - 7.2.3: Access Privileges Are Granted by Authorized Personnel
Copy Link
PCI v4.0 - 7.2.4: Periodically Review Access Privileges
Copy Link
PCI v4.0 - 7.2.5.1: Review Application and System Access Privileges
Copy Link
PCI v4.0 - 7.2.5: Assign and Manage System and Application Access Privileges Appropriately
Copy Link
PCI v4.0 - 7.2.6: Restrict Access to Query Repositories of Cardholder Data
Copy Link
PCI v4.0 - 7.3.1: Have an Access Control System In Place
Copy Link
PCI v4.0 - 7.3.2: Access Control System Is Configured Correctly
Copy Link
PCI v4.0 - 7.3.3: Access Control System Is Set to Deny All By Default
Copy Link
PCI v4.0 - 8.1.1: Have Requirement 8 Policies and Procedures In Place
Copy Link
PCI v4.0 - 8.1.2: Have Requirement 8 Roles and Responsibilities In Place
Copy Link
PCI v4.0 - 8.2.1: All Users Are Assigned Unique User IDs
Copy Link
PCI v4.0 - 8.2.2: Group Shared or Generic Accounts Are Only Used When Necessary
Copy Link
PCI v4.0 - 8.2.3: (Service Providers) Use Unique Authentication Factors to Remotely Access Customer Premises
Copy Link
PCI v4.0 - 8.2.4: User IDs and Identifier Objects Are Managed Appropriately
Copy Link
PCI v4.0 - 8.2.5: Revoke Access for Terminated Users Immediately
Copy Link
PCI v4.0 - 8.2.6: Inactive User Accounts Are Removed or Disabled
Copy Link
PCI v4.0 - 8.2.7: Properly Manage Accounts Used By Third Parties
Copy Link
PCI v4.0 - 8.2.8: Require Reauthentication if User Session Has Been Idle for More Than 15 Minutes
Copy Link
PCI v4.0 - 8.3.10.1: (Service Providers) Change Customer User Passwords and Passphrases Once Every 90 Days
Copy Link
PCI v4.0 - 8.3.10: (Service Providers) Provide Password and Passphrase Guidance to Customer Users
Copy Link
PCI v4.0 - 8.3.11: Assign Authentication Factors to Individual Users
Copy Link
PCI v4.0 - 8.3.1: Access to System Components Is Properly Authenticated
Copy Link
PCI v4.0 - 8.3.2: Use Strong Cryptography on All Authentication Factors
Copy Link
PCI v4.0 - 8.3.3: Verify User Identify Before Modifying Any Authentication Factor
Copy Link
PCI v4.0 - 8.3.4: Limit Invalid Authentication Attempts
Copy Link
PCI v4.0 - 8.3.5: Set and Reset Passphrases and Passwords Appropriately
Copy Link
PCI v4.0 - 8.3.6: Ensure Passphrases and Passwords Meet Minimum Levels of Complexity
Copy Link
PCI v4.0 - 8.3.7: Passwords Are Not the Same as at Least the Previous Four Passwords
Copy Link
PCI v4.0 - 8.3.8: Authentication Policies and Procedures Are Documented and Communicated
Copy Link
PCI v4.0 - 8.3.9: Passwords and Passphrases Are Changed Once Every 90 Days
Copy Link
PCI v4.0 - 8.4.1: Multi-Factor Authentication Is Implemented for All Non-Console Access
Copy Link
PCI v4.0 - 8.4.2: Multi-Factor Authentication Is Implemented for All Access to Cardholder Data Environment
Copy Link
PCI v4.0 - 8.4.3: Multi-Factor Authentication Is Utilized for All Remote Network Access
Copy Link
PCI v4.0 - 8.5.1: Multi-Factor Authentication Systems Are Implemented Appropriately
Copy Link
PCI v4.0 - 8.6.1: Interactive Logins Are Managed Properly
Copy Link
PCI v4.0 - 8.6.2: Passwords and Passphrases For System Accounts Are Not Hardcoded
Copy Link
PCI v4.0 - 8.6.3: Passwords and Passphrases Are Protected from Misuse
Copy Link
PCI v4.0 - 9.1.1: Requirement 9 Policies and Procedures Are In Place
Copy Link
PCI v4.0 - 9.1.2: Requirement 9 Roles and Responsibilities Are In Place
Copy Link
PCI v4.0 - 9.2.1 & 9.2.1.1: Monitor and Restrict Physical Access to Cardholder Data Environment Areas
Copy Link
PCI v4.0 - 9.2.2: Restrict the Use of Publicly Accessible Network Jacks
Copy Link
PCI v4.0 - 9.2.3: Access to Network Access Points Is Restricted
Copy Link
PCI v4.0 - 9.2.4: Console Access in Sensitive Data Area Is Restricted
Copy Link
PCI v4.0 - 9.3.1.1: Physical Access to Sensitive Areas Within the Cardholder Data Environment Is Controlled
Copy Link
PCI v4.0 - 9.3.1: Procedures Are In Place for Physical Access to the Cardholder Data Environment
Copy Link
PCI v4.0 - 9.3.2: Implement Procedures for Visitor Access to the Cardholder Data Environment
Copy Link
PCI v4.0 - 9.3.3: Visitor Badges or Identification Are Surrendered Before Leaving
Copy Link
PCI v4.0 - 9.3.4: Maintain a Visitor Log
Copy Link
PCI v4.0 - 9.4.2: All Media with Cardholder Data Is Classified
Copy Link
PCI v4.0 - 9.4.3: Properly Secure Media with Cardholder Data Sent Outside the Facility
Copy Link
PCI v4.0 - 9.4.4: Management Approves Sending Media with Cardholder Data Outside the Facility
Copy Link
PCI v4.0 - 9.4.5 & 9.4.5.1: Inventory Logs of Electronic Media with Cardholder Data Are Maintained
Copy Link
PCI v4.0 - 9.4.6: Hard-Copy Materials with Cardholder Data Are Destroyed
Copy Link
PCI v4.0 - 9.4.7: Destroy Digital Media With Cardholder Data
Copy Link
PCI v4.0 - 9.5.1.1: Maintain an Up-to-Date List of Point-of-Interaction Devices
Copy Link
PCI v4.0 - 9.5.1.2 & 9.5.1.2.1: Periodically Inspect Point-of-Interaction Devices
Copy Link
PCI v4.0 - 9.5.1.3: Provide Training for Personnel in Point-of-Interaction Environments
Copy Link
PCI v4.0 - 9.5.1: Point-of-Interaction Devices Are Protected
Copy Link
PCI v4.0 - A1.1.1: (Multi-Tenant Service Providers) Logical Separation Is Implemented Appropriately
Copy Link
PCI v4.0 - A1.1.2: (Multi-Tenant Service Providers) Each Customer Can Only Access Its Own Data and Environment
Copy Link
PCI v4.0 - A1.1.3: (Multi-Tenant Service Providers) Customers Can Only Access Resources Allocated to Them
Copy Link
PCI v4.0 - A1.1.4: (Multi-Tenant Service Providers) Logical Separation Control Effectiveness Is Tested Regularly
Copy Link
PCI v4.0 - A1.2.1: (Multi-Tenant Service Providers) Ensure Appropriate Logging Is Enabled
Copy Link
PCI v4.0 - A1.2.2: (Multi-Tenant Service Providers) Implement Processes to Support Forensic Investigations
Copy Link
PCI v4.0 - A1.2.3: (Multi-Tenant Service Providers) Implement Processes for Reporting and Addressing Security Incidents
Copy Link
Perform Internal and External Vulnerability Scans
Copy Link
Physical Security Policy in a Remote World
Copy Link
Policy to Prohibit Cardholder Data on Remote Technology
Copy Link
Prepare for a Formal Audit
Copy Link
Principles of Data Protection
Copy Link
Professional Teamwork in Cybersecurity
Copy Link
Protect Cardholder Data Over the Internet
Copy Link
Protect Your Data with PCI DSS
Copy Link
Publish and Maintain an Information Security Policy
Copy Link
Quarterly Reviews of Your Security Program
Copy Link
Safeguard Against Outsiders with a System & Services Acquisition Policy
Copy Link
Screen Employees to Reduce Risk
Copy Link
Security Awareness Training Best Practices
Copy Link
Service Providers to Establish Charters for Information Security Program
Copy Link
Set Expectations for Daily and Quarterly Reviews in Your Policy
Copy Link
The Components of a System Security Plan
Copy Link
The Importance of Keeping Security Training Records
Copy Link
The Importance of Publishing an Information Security Policy
Copy Link
The Importance of Responsibility Acknowledgement from Service Providers
Copy Link
The Importance of a Perimeter Security Monitoring Policy
Copy Link
The Importance of an Awareness and Training Cybersecurity Policy
Copy Link
Third Parties and Your PCI DSS Assessment
Copy Link
Transfer of Legal Risk
Copy Link
Update Your Policy When Your Environment Changes
Copy Link
Use Alerts to Enforce Your Access Control Policy
Copy Link
Use Contracts for BYO Technology
Copy Link
Verify Internal Log Processes
Copy Link
What Data Does PCI DSS Apply To?
Copy Link
What Is An Information Exchange Agreement?
Copy Link
What Is a Cybersecurity Policy?
Copy Link
What Is a Policy?
Copy Link
What Should Be Included in an Incident Response Policy?
Copy Link
What are the Different Levels of Security Awareness Training?
Copy Link
What is a 4th Party Questionnaire?
Copy Link
What is an Access Control Cybersecurity Policy?
Copy Link
What is an Audit and Accountability Cybersecurity Policy?
Copy Link
What is an Information Security Policy?
Copy Link
What to Include in Your Media Protection Policy
Copy Link
What to Include in a List of Service Providers
Copy Link
What to Include in a Security Policy
Copy Link
What to Include in a Separation of Duties Cybersecurity Policy
Copy Link
What to Include in a Written Contract with Service Providers
Copy Link
Who Does PCI DSS Apply To?
Copy Link
Who Is Involved In PCI?
Copy Link