S

PCI DSS One Day

Training
SISA INFORMATION SECURITY




- .1,4.-
91(3=

-DA





- .1,4.-
91(3=
:3D
3A

-(




- .1,4.-
91(3=
A
'1(-




- .1,4.-
91(3=
3D
3DA
(-&/.1




- .1,4.-
91(3=

A
9(

The small print

'
-,2
.
,1'-32A
21:(
/1.:(12A
-*2
,-4.-
91(-&
3'
.912
.
3'

;.1*2'./
1
.-+=
.1
<,/+
/91/.22D
'=
2'.9+
-.3

.-2319
3.
(-(3

-=3'(-&
:12
.1
;1.-& 9+
.-
3'(1
1 1-D

'
-,2
.
3'
3..+2
,-4.-
91(-&
3'
;.1*2'./
1
.-+=
.1
<,/+
/91/.22

-
.2
-.3
.!1

.,/1'-2(:
3..+
+(23
3'3
<(232
(-
3'
,1*3
/+D

'(+
3'


31(-1
(2
'(&'+=
1&1
-
09+("
3.
.-93
3'
31(-(-&A
3'

31(-1
(2
-(3'1
3'
2/.*2/12.-
.



-.1


D

R
XVW[



- .1,4.-
91(3=

-D
W

 Introduction
$,-$)
$).$(1,.$58


*1),
)
$%
41/2
",

/$"-'&+6

5
:5
 5
 5
5
5

?C==>
%($%&,*5
5

; :<
/,!'*"4

*"&*
&
0"+'*5
 
*-

(($"-'&
&
+,*
;<5
"*'+'
*-
*'++"'&$
;<5




- .1,4.-
91(3=

-D
(2

9--=:+
2
=,-3
91(3=
2291-
.,/-=D


'2

/12-
(-

-(A
(-&/.1
-
(+
23D


;2
23
9/
(-
XVVY
-
2(-
3'-
'2
;.1*
;(3'



,.1
3'-
WAVVV
.1&-(>4.-2
2

A
I
-
D


'2
31(-
.:1
[AVVV
/1. 22(.-+2
.-

/=,-3
291(3=
;(3'
(32
$&2'(/
14"4.-


D

'12'-
;2
3'
/1./.21
-
+
.1
3'




(2*
2222,-3
1.9/
3'3
93'.1
3'



(2*
2222,-3
&9(-
.9,-3D


   











Background

1,%)#
,#)%6/*)-
%)
*2,
FC
*1).,%-
-+,
,*--
)&-8

) *,(/*)
$)*'*#58

)-1,)8
<
*((,8
5().
,2%
+,*2%,-8
%,'%)-8
'*((1)%/*)-
)
.%'
%)1-.,%-:

o
-=
"1232
(-




o


,/+,-34.-
.1*2'./
N

O
-
.1,+
(2*
2222,-3
.1*2'./
N
O

o
1(-
,.1
3'-
[AVVV

- .1,4.-
291(3=
/1. 22(.-+2
1.9-
3'
&+.

o
(.-12
.
=-1&4
91(3=
1,;.1*

R
XVW[



- .1,4.-
91(3=

-D
X

 1:(2
1(-(-&
1.93

*(+'%)
,2%-



8
<8



8



8
E8







2%-*,5
,2%-

%-&
----().

*,('
%-&
----().
3*,&-$*+
>
?

%#
.8
,%25
%,.1'%6/*)8
'*1


1,%.58
 ;

1,%.58
%-&
----().




(+'()./*)
*,&-$*+
>

?
/*)
)#().





$)%'
1,%.5
,2%-
1,
5().
++'%/*)
2'*+().
.
%-*2,5
**'


8
*%'
1,%.58
*,)-%-

*,&-$*+
>

<?



*1().
)#().

1++*,.
,2%-



(+'()./*)
*,&-$*+

,*1.
2'1/*)-8
*'%5;,*1,-
*(+'%)
)#().

-1++*,.8
;









%'%..


SISA






 

R
XVW[



- .1,4.-
91(3=

-D
Y

 Ground rules

++
'.-2
.
(13

:1=.=
14(/32

(23-
4:+=

'1
.91
-.;+&
N93

1( O


/-
(-

2*
924.-2

N

',/(.-

.1
&..
0924.-2O

Objective
-123-
3'
=,-3
1
.2=23,




.,/+(-
1.&1,

-123-



12(.-
YDV
09(1,-32

.,/1(2.-
3;-
12(.-
XDV
-
YDV

9(-
.-



(2*
2222,-32A
I.,,1A
(139+H+.9

09(1,-32
.-




R
XVW[



- .1,4.-
91(3=

-D
Z

 INTRODUCTION TO
PCI-DSS
BACKGROUND CONCEPTS COMMONPLACE EVENTS
PCI COUNCIL

The Protagonist
1(,1=
.9-3
9,1



 





 
 





 



R
XVW[



- .1,4.-
91(3=

-D
[

 The other side

&-4
31(/

(&-391
+


X

ELEMENTS REQUIRED FOR

PAYMENT



 

I


 








 
 





X

R
XVW[



- .1,4.-
91(3=

-D
\

 TRACK and CHIP
1*
W
3

1*
X
3

1*
Y
3

-+=
1*
X
(2
92
.1
"--(+
31-24.-2


91(3=
2912

'.+
+.3
.
-*(-&
3912

Track 1 and Track 2

10 20 30 40 50 56

B 4 0 0 0 0 0 1 2 3 4 5 6 2 ^ P U B L I C J R / J O H N Q M R ^ 0 8 0 9 1 0 1 0 0 8 7 6 0 0 0 0 0 0

Format
Code
PAN
Separator
Title Separator
CVV/CVC
Suffix Reserved
Surname For
Separator Proprietary
use of
First Name Card issuer

Initial

Title

Title Separator

Expiration Date

Service Code

R
XVW[



- .1,4.-
91(3=

-D
]

 The Who is Who

 




 






The Service Providers






-
/1.:(
-=
21:(
3.
-=
.3'1
-43=

R
XVW[



- .1,4.-
91(3=

-D
^

 Service Provider Examples
+24
1
,.22(-&D

,(6-
/1.22(-&
-
93'-44.-
1.:(12

-&
"1;++
-


21:(
/1.:(12D

.%;1
:+./,-3
.,/-(2A
92(-22
1.22
932.91(-&
.,/-(2A
++

-312A
3D

.1




+(4.-
.-209-3
3.
'-+(-&
1'.+1

3D


.,
21:(
/1.:(12
,=
-.3

(-+9
29'
2
3+.,,9-(4.-2
.,/-(2
3'3

.-+=
/1.:(
.,,9-(4.-2
+(-*2
;(3'.93
22
3.
3'
//+(4.-
+=1
.
3'

.,,9-(4.-
+(-*D

Transactions Card Present





M
M











 

 

R
XVW[



- .1,4.-
91(3=

-D
_

 Transactions Card Not Present





M
M











 


 

The core processing actions

 


I
23+(2'
3'
;'.

 



I
+(4.-
.-
=
3'
(2291





I
++
4:(42
+(-&
3.
26+,-3

 

I
++
92
/(
=
:1=.-

R
XVW[



- .1,4.-
91(3=

-D
WV

 Payment Card Fraud Evolution
W_^Y

I,.22
.9-31 (3
19

W_^^

I-.
.9-31 (3
19

W_^_

1
-.3
/12-3
19H
19
//+(4.-2

W__W

:1
1(:
(229
19

W__X

1'-3
19

W__Z


-43=
'%

XVVV

*(,,
.9-31 (3

XVVX

.,,9-(4.-2
(-31/4.-

XVV]

(1+22H
'(/
2-(#-&
-
1
.9-31 (3H
*
31,(-+2

XVWVIW[
1:1
*(-&H +;1H ,.1=
1//(-&

PCI SSC

5().
,

)1-.,5
1,%.5
.),-
*1)%'

-
(-/--3
(-9231=
23-12
.=
/1.:((-&
.:12(&'3
.
3'
:+./,-3
-
,-&,-3
.

=,-3
1

-9231=
91(3=
3-12
.-

&+.+
2(2

R
XVW[



- .1,4.-
91(3=

-D
WW

 ROUTE TO
COMPLIANCE
PCI-DSS REQUIREMENTS COMPLIANCE FINDING CARD
NUMBERS

PCI-SSC Mandate


I
.,/+(-
//+(2
3.
-=
-43=
3'3


.*,-
.9-3
3

,*---
.9-3
3

,)-(%.-
.9-3
3

.9-3
3
.-2(232
.
1'.+1
3
-
2-2(4:
93'-44.-
3

)//-
(-+9A
93
-.3
+(,(3
3.C

1'-32


09(112


22912


1:(
1.:(12

1923
'(1
142

R
XVW[



- .1,4.-
91(3=

-D
WX

 Driving the Compliance
 


;


1-&
=,-3
1-

.--4:(3=


=
 


,+22

-3&14.-
1.22(-&
 

 
 





=


PCI-DSS Certification

2222,-3
,(4.-
14"4.-

./(-&
9(3

(4&4.-



(2*
2222,-3
H

(+23.-
:(;2

/
-+=2(2
14"3
.
.,/+(-

R
XVW[



- .1,4.-
91(3=

-D
WY

 The most important slide

PCI-DSS v3.0
1%'
)
%).%)

1,
.3*,&
)
5-.(-



D:

-23++
-
,(-3(-

"1;++
.-"&914.-
3.
/1.33
1'.+1
3


E:
.
-.3
92
:-.1I29//+(
 9+32
.1
2=23,
/22;.12
-
.3'1
291(3=
/1,312





,*..
,$*',
.



F:
1.33
23.1
1'.+1
3


G:
-1=/3
31-2,(22(.-
.
1'.+1
3
1.22
./-A
/9+(
-3;.1*2





%).%)

1'),%'%.5
)#().
,*#,(



H:
1.33
++
2=23,2
&(-23
,+;1
-
1&9+1+=
9/3
-4I:(192
2.%;1
.1
/1.&1,2


I:
:+./
-
,(-3(-
291
2=23,2
-
//+(4.-2

R
XVW[



- .1,4.-
91(3=

-D
WZ

 PCI-DSS v3.0


(+'().
.,*)#
--
*).,*'
-1,-




J:
231(3
22
3.
1'.+1
3
=
92(-22
-
3.
*-.;



K:

-4 =
-
93'-43
22
3.
2=23,
.,/.--32



L:
231(3
/'=2(+
22
3.
1'.+1
3







#1','5
*)%.*,
)
-.
.3*,&-




DC:
1*
-
,.-(3.1
++
22
3.
-3;.1*
12.912
-
1'.+1
3



DD:
&9+1+=
323
291(3=
2=23,2
-
/1.222







%).%)
)

) *,(/*)
1,%.5
*'%5




DE:
(-3(-

/.+(=
3'3
1222
(- .1,4.-
291(3=
.1
++
/12.--+

PCI Risk Assessment Flow

),'
-,%+/*)
*


*+

--.

$,.

%-&
)'5-%-9
%-&

)/!/*)

1'),%'%/-

%-&
)'5-%-9
%-&
-/(/*)
)
2'1/*)
%-&
,*!'%)#

%-&
,.().
')

%-&
,.().
-1'.-
*1()./*)

R
XVW[



- .1,4.-
91(3=

-D
W[

 Recap

WD LLLLLLLLLL
/=,-3
1-
(2
-:1
-
09(11
.1
(2291D

XD 


(2
,-&
=
LLLLLLLLLLLLLLLLD

YD 


(2
//+(+
3.
-=
.1&-(>4.-
3'3
LLLLLLLLLLLLA
LLLLLLLLLLLLLL


LLLLLLLLLLLLL
1'.+1
(- .1,4.-D

ZD - .1,-3
.



(2
.-
=
LLLLLL




LLLLLLLL
D

Where do we find card data

-=;'1

.3*,&
,"
.--
%'-
+*,.-
*#-

R
XVW[



- .1,4.-
91(3=

-D
W\

 Mod 10 Formula Luhns Algorithm
WD .9+
3'
:+9
.
+31-3
(&(32
.
3'
/1(,1=
.9-3
-9,1
&(--(-&
;(3'
3'
2.-

(&(3
1.,
3'
1(&'3D

.1
-=
129+4-&
:+9a`WVA
29313
_D

XD 
3'
+9+3
:+92
2
;++
2
3'
:+92
2*(//
(-

3/
W
3.&3'1D

YD '
3.3+
.3(-
(-
3/
X
,923

(:(2(+
=
WVD

4 4 0 8 9 8 5 5 0 0 0 0 0 5 8 5

x2 x2 x2 x2 x2 x2 x2 x2

8 0 18 10 0 0 0 16

-9 -9 -9

8 4 0 8 9 8 1 5 0 0 0 0 0 5 7 5

Exercise 1 :

'*
;'3'1
3'
.++.;(-&
W\
(&(3
-9,12
1
:+(
1
-9,12
C

[Z_VWXYZ[\]^_WXY


ZVZ^YZY][VVW_][Z


-(:(9+
4:(3=

(,
914.-
C
W[
(-932

R
XVW[



- .1,4.-
91(3=

-D
W]

 Oh and yes 

9++
31*
3
-
2-2(4:
93'-44.-
3
--.3


23.1
%1
93'.1(>4.-D

Scoping relevant systems




291(3=
109(1,-32
//+=
3.
++

2=23,
.,/.--32D

=23,
.,/.--3
I
-=
-3;.1*

.,/.--3A
21:1A
.1
//+(4.-
3'3
(2

(-+9
(-
.1
.--3
3.
3'

1'.+1
3
-:(1.-,-3D


=23,
.,/.--3
+2.
(-+9
-=

:(139+(>4.-
.,/.--32D


1'.+1
3
-:(1.-,-3
(2
3'3
/13

.
3'
-3;.1*
3'3
23.12A
/1.222A

-H.1
31-2,(32
1'.+1
3
.1

2-2(4:
93'-44.-
3D

(139+(>4.-
.,/.--32
(-+9
:(139+

,'(-2A
:(139+
2;(3'2H1.9312A
:(139+

//+(-2A
:(139+
//+(4.-2H2*3./2

-
'=/1:(2.12D

R
XVW[



- .1,4.-
91(3=

-D
W^

 Scoping out - Network

Requirement 1: Install and maintain a firewall configuration to protect

cardholder data

D:D
23+(2'
-
(,/+,-3
"1;++
-
1.931
.-"&914.-
23-12

D:E
9(+
"1;++
-
1.931
.-"&914.-2
3'3
1231(3
.--4.-2
3;-
9-31923
-3;.1*2
-
-=

2=23,
.,/.--32
(-
3'
1'.+1
3
-:(1.-,-3D

D:F
1.'((3
(13
/9+(
22
3;-
3'

-31-3
-
-=
2=23,
.,/.--3
(-
3'
1'.+1
3

-:(1.-,-3D


D:G

-23++
/12.-+
"1;++
2.%;1
.-
-=
,.(+
-H.1
,/+.=I.;-
:(2
3'3
.--3
3.
3'


-31-3
;'-
.932(
3'
-3;.1*
N .1
<,/+A
+/3./2
92
=
,/+.=2OA
-
;'('
1
+2.
92
3.

22
3'
-3;.1*D


D:H
-291
3'3
291(3=
/.+((2
-
./14.-+
/1.912
.1
,-&(-&
"1;++2
1
.9,-3A
(-
92A

-
*-.;-
3.
++
!3
/142D

R
XVW[



- .1,4.-
91(3=

-D
W_

 Requirement 2: Do not use vendor-supplied defaults for system passwords
and other security parameters

E:D
+;=2
'-&
:-.1I29//+(
 9+32
-
1,.:
.1
(2+
9--221=
 9+3
.9-32
 .1
(-23++(-&


2=23,
.-
3'
-3;.1*D

'(2
//+(2
3.

 9+3
/22;.12A
(-+9(-&
93
-.3
+(,(3
3.
3'.2
92
=
./14-&
2=23,2A
2.%;1
3'3

/1.:(2
291(3=
21:(2A
//+(4.-
-
2=23,
.9-32A
/.(-3I. I2+
NO
31,(-+2A
(,/+
3;.1*
-&,-3

1.3..+
N O
.,,9-(3=
231(-&2A
3DOD

E:E
:+./
.-"&914.-
23-12
.1
++
2=23,
.,/.--32D
2291
3'3
3'2
23-12
122
++
*-.;-
291(3=

:9+-1(+(42
-
1
.-2(23-3
;(3'
(-9231=I/3
2=23,
'1-(-&
23-12D
.912
.
(-9231=I/3

2=23,
'1-(-&
23-12

E:F
-1=/3
++
-.-I.-2.+
,(-(2314:
22
92(-&
231.-&
1=/3.&1/'=D
2
3'-.+.&(2
29'
2
 A
A
.1
H

.1
;I2
,-&,-3
-
.3'1
-.-I.-2.+
,(-(2314:
22D

Requirement 2: Do not use vendor-supplied defaults for system passwords

and other security parameters

E:G
(-3(-
-
(-:-3.1=
.
2=23,
.,/.--32
3'3
1
(-
2./
.1


D

E:H
-291
3'3
291(3=
/.+((2
-
./14.-+
/1.912
.1
,-&(-&
:-.1
 9+32
-
.3'1
291(3=

/1,312
1
.9,-3A
(-
92A
-
*-.;-
3.
++
!3
/142D

E:I
'1
'.24-&
/1.:(12
,923
/1.33
'
-43=E2
'.23
-:(1.-,-3
-
1'.+1
3D
'2

/1.:(12
,923
,3
2/("
109(1,-32
2
3(+
(-
((&"2
6
"-'&$


)/"*%&,+
'*

!*
'+-&
*'0"*+7

R
XVW[



- .1,4.-
91(3=

-D
XV

 Exercise 2 : Firewall Rule Review
1'
*
*1,
-/)/*)
,2%-
/*)

W


1:1
A

/3

X


-31-+
1:1

/3

Y
W_XDW\^DWDV

1:1

/3

Z


1:1

XW
/3

[

(+
1:1
 A
Y
/3

\

-31-+
1:1


/3

]
32
1:1


/3

^

32
1:1

/3

_
WXXDY]DZWDY^


/3

WV


A 
/3

WW



/3


-(:(9+
4:(3=

(,
914.-
C
W[
(-932

Identifying the data

-4 =
++
2=23,2
3'3
23.1A
/1.22A
.1
31-2,(3
1'.+1
3

13

,31(<
.
2=23,2
(-+9(-&

=23,
-,

1'.+1
3
23.1
N+(23
"+2O

3-4.-
/1(.

1.34.-
,'-(2,

1.33
23.1
2
/1



YDZ
N'2'(-&A
-1=/4.-A
.1
319-4.-O



-
.1&-(>4.-
--.3
1-1
1'.+1
3
9-1+A
(3
(2
++.;+
3.
94+(>

.,/-24.-
.-31.+2
3.
/1.:(
.1&-(>4.-
':
9-13*-


1(2*
-+=2(2

-
':

+&(4,3
3'-.+.&(+

.1
.9,-3
92(-22
.-231(-32D

R
XVW[



- .1,4.-
91(3=

-D
XW

 Card Holder Matrix

++'%/*)
(
,-%*)
++'%/*)

.-
'
(
)
.)/*)
,*./*)

-,%+/*)
$(
*'1()
)(
,%*



XDX

%-


++'%/*)
=
J
'
)(
=
X
=12
.-

'*.
%)
.$

-.*,-:

.

.,4.%'

+,*---
@
.*,-

 
',
*'1()
)(
=

,)*

,2,
(


%'
(
;
*/*)
3$,
.
.*,
1-%)--
,-*)
.)/*)
,*./*)

,--
.$
 
-.*,
,%*

3.1LL21:1
W_XDW\^ 5

1
*,
$,#&
X
=12
.-

DWVD[
-9,1

Requirement 3: Protect stored cardholder data

F:D


/
1'.+1
3
23.1&
3.

,(-(,9,
=
(,/+,-4-&
3
13-4.-
-
(2/.2+
/.+((2A

/1.912
-
/1.222
3'3
(-+9
3
+23
3'
.++.;(-&
.1
++
1'.+1
3
N O
23.1&C

(,(4-&
3
23.1&
,.9-3
-
13-4.-
4,
3.
3'3
;'('
(2
109(1
.1
+&+A
1&9+3.1=A
-

92(-22
109(1,-32

1.222
.1
291
+4.-
.
3
;'-
-.
+.-&1
-

/("
13-4.-
109(1,-32
.1
1'.+1
3


09131+=
/1.22
.1
(-4 =(-&
-
291+=
+4-&
23.1
1'.+1
3
3'3
<2

"-




13-4.-D

R
XVW[



- .1,4.-
91(3=

-D
XX

 Requirement 3: Protect stored cardholder data

F:E

.
-.3
23.1
2-2(4:
93'-44.-
3
%1
93'.1(>4.-
N:-
(
-1=/3OD


2-2(4:
93'-44.-

3
(2
1(:A
1-1
++
3
9-1.:1+
9/.-
.,/+4.-
.
3'
93'.1(>4.-
/1.22D

,
"+
(*%"++"$
'*
"++/*+
&
'%(&"+
,!,
+/(('*,
"++/"&
+*0"+
,'
+,'*
+&+"-0
/,!&--'&
,
"6

'1
(2

92(-22
)924"4.-

'
3
(2
23.1
291+=D

F:F
2*

;'-
(2/+=
N3'
"123
2(<
-
+23
.91
(&(32
1
3'
,<(,9,
-9,1
.
(&(32
3.


(2/+=OA
29'
3'3
.-+=
/12.--+
;(3'

+&(4,3
92(-22
-
-
2
3'
9++
D

Requirement 3: Protect stored cardholder data

F:G
-1

9-1+
-=;'1
(3
(2
23.1
N(-+9(-&
.-
/.13+
(&(3+
,(A
*9/
,(A
-

(-
+.&2O
=
92(-&
-=
.
3'
.++.;(-&
//1.'2C

M

-I;=
'2'2
2
.-
231.-&
1=/3.&1/'=A
N'2'
,923

.
3'
-41
O

M

19-4.-
N'2'(-&
--.3

92
3.
1/+
3'
319-3
2&,-3
.
O

M


-<
3.*-2
-
/2
N/2
,923

291+=
23.1O

M

31.-&
1=/3.&1/'=
;(3'
22.(3
*=I,-&,-3
/1.222
-
/1.912D





,
"+

*$-0$3
,*"0"$
'*,
'*

%$""'/+
"&"0"/$
,'
*'&+,*/,
'*" "&$

,
"
,!3
!0

++
,'
',!
,!
,*/&,
&
!+!
0*+"'&
'

 7
!*
!+!
&
,*/&,
0*+"'&+
'
,!

+%

*
(*+&,
"&
&
&-,38+
&0"*'&%&,5
"-'&$
'&,*'$+
+!'/$

"&
($
,'
&+/*
,!,
,!

!+!
&
,*/&,
0*+"'&+
&&',

'**$,
,'
*'&+,*/,
,!
'*" "&$
 7

R
XVW[



- .1,4.-
91(3=

-D
XY

 Requirement 3: Protect stored cardholder data

F:H
.9,-3
-
(,/+,-3
/1.912
3.
/1.33
*=2
92
3.
291
23.1
1'.+1
3
&(-23

(2+.291
-
,(292


F:I
9++=
.9,-3
-
(,/+,-3
++
*=I,-&,-3
/1.222
-
/1.912
.1
1=/3.&1/'(
*=2

92
.1
-1=/4.-
.
1'.+1
3D


/%*'/+
"&/+,*3
+,&*+
'*
#3
%& %&,
*
0"$$
*'%
0*"'/+
*+'/*+
"&$/"&
5

1!"!
&

'/&
,
!.(699+*7&"+,7 '07

Requirement 4: Encrypt transmission of cardholder data across open, public

networks

G:D
2
231.-&
1=/3.&1/'=
-
291(3=
/1.3..+2
N .1
<,/+A
HA

A
 A
3DO
3.
2 &91

2-2(4:
1'.+1
3
91(-&
31-2,(22(.-
.:1
./-A
/9+(
-3;.1*2A
(-+9(-&
3'
.++.;(-&C


-+=
31923
*=2
-
14"32
1
/3D


'
/1.3..+
(-
92
.-+=
29//.132
291
:12(.-2
.1
.-"&914.-2D


'
-1=/4.-
231-&3'
(2
//1./1(3
.1
3'
-1=/4.-
,3'..+.&=
(-
92D





<,/+2
.
./-A
/9+(
-3;.1*2
(-+9
93
1
-.3
+(,(3
3.C


'

-31-3


(1+22
3'-.+.&(2A
(-+9(-&
^VXDWW
-
+93..3'


++9+1
3'-.+.&(2A
.1
<,/+A
+.+
=23,
.1
.(+
.,,9-(4.-2
N OA
.
(:(2(.-
,9+4/+

22
N O


-1+
*3
(.
1:(
NOD


3++(3
.,,9-(4.-2D

R
XVW[



- .1,4.-
91(3=

-D
XZ

 Requirement 4: Encrypt transmission of cardholder data
across open, public networks

G:E
:1
2-
9-/1.33
2
=
-I921
,22&(-&
3'-.+.&(2
N .1
<,/+A
I,(+A
(-23-3

,22&(-&A
'3A
3DOD

G:F
-291
3'3
291(3=
/.+((2
-
./14.-+
/1.912
.1
-1=/4-&
31-2,(22(.-2
.
1'.+1
3

1
.9,-3A
(-
92A
-
*-.;-
3.
++
!3
/142D

Requirement 5: Protect all systems against malware and regularly update

anti-virus software or programs

[DW
/+.=
-4I:(192
2.%;1
.-
++
2=23,2
.,,.-+=
!3
=
,+((.92
2.%;1
N/149+1+=
/12.-+

.,/9312
-
21:12OD


[DWDW
-291
3'3
-4I:(192
/1.&1,2
1
/+
.
34-&A
1,.:(-&A
-
/1.34-&
&(-23
++
*-.;-

3=/2
.
,+((.92
2.%;1D


[DWDX
.1
2=23,2
.-2(1
3.

-.3
.,,.-+=
!3
=
,+((.92
2.%;1A
/1 .1,
/1(.(

:+94.-2
3.
(-4 =
-
:+93
:.+:(-&
,+;1
3'132
(-
.11
3.
.-"1,
;'3'1
29'
2=23,2

.-4-9
3.
-.3
109(1
-4I:(192
2.%;1D


[DX
-291
3'3
++
-4I:(192
,'-(2,2
1
,(-3(-
2
.++.;2C


1
*/3
911-3A


1 .1,
/1(.(
2-2


-13
9(3
+.&2
;'('
1
13(-
/1



09(1,-3
WVD]D

R
XVW[



- .1,4.-
91(3=

-D
X[

 Requirement 5: Protect all systems against malware and regularly update
anti-virus software or programs

[DY
-291
3'3
-4I:(192
,'-(2,2
1
4:+=
19--(-&
-
--.3

(2+
.1
+31
=
9212A
9-+22

2/("++=
93'.1(>
=
,-&,-3
.-

2I=I2
2(2
.1

+(,(3
4,
/1(.D

.3C
-4I:(192
2.+94.-2
,=

3,/.11(+=
(2+
.-+=
(
3'1
(2
+&(4,3
3'-(+
-A
2
93'.1(>

=
,-&,-3
.-

2I=I2
2(2D


-4I:(192
/1.34.-
-2
3.

(2+
.1

2/("
/91/.2A
(3

,923

.1,++=
93'.1(>D
(4.-+
291(3=
,2912
,=
+2.
-
3.

(,/+,-3
.1
3'
/1(.

.
4,
91(-&
;'('
-4I:(192
/1.34.-
(2
-.3
4:D

[DZ
-291
3'3
291(3=
/.+((2
-
./14.-+
/1.912
.1
/1.34-&
2=23,2
&(-23
,+;1
1

.9,-3A
(-
92A
-
*-.;-
3.
++
!3
/142D

Requirement 6: Develop and maintain secure systems and applications

\DW
23+(2'

/1.22
3.
(-4 =
291(3=
:9+-1(+(42A
92(-&
1/93+
.932(
2.912
.1
291(3=
:9+-1(+(3=

(- .1,4.-A
-
22(&-

1(2*
1-*(-&
N .1
<,/+A
2
F'(&'AG
F,(9,AG
.1
F+.;GO
3.
-;+=
(2.:1
291(3=

:9+-1(+(42D

.3C
(2*
1-*(-&2
2'.9+

2
.-
(-9231=
23
/142
2
;++
2
.-2(14.-
.
/.3-4+
(,/3D
.1
<,/+A

1(31(
.1
1-*(-&
:9+-1(+(42
,=
(-+9
.-2(14.-
.
3'

2
2.1A
-H.1
3'
+22("4.-
=
3'

:-.1A
-H.1
3=/
.
2=23,2
!3D

3'.2
.1
:+94-&
:9+-1(+(42
-
22(&-(-&
1(2*
14-&2
;(++
:1=
2
.-
-
.1&-(>4.-E2
-:(1.-,-3
-
1(2*I
2222,-3
2313&=D
(2*
1-*(-&2
2'.9+A
3

,(-(,9,A
(-4 =
++
:9+-1(+(42
.-2(1
3.


F'(&'
1(2*G
3.
3'

-:(1.-,-3D

-
(4.-
3.
3'
1(2*
1-*(-&A
:9+-1(+(42
,=

.-2(1
F1(4+G
(
3'=
/.2
-
(,,(--3
3'13
3.

3'
-:(1.-,-3A
(,/3
1(4+
2=23,2A
-H.1
;.9+
129+3
(-

/.3-4+
.,/1.,(2
(
-.3
122D
<,/+2
.

1(4+
2=23,2
,=
(-+9
291(3=
2=23,2A
/9+(I (-&
:(2
-
2=23,2A
322A
-
.3'1
2=23,2
3'3
23.1A

/1.22A
.1
31-2,(3
1'.+1
3D

R
XVW[



- .1,4.-
91(3=

-D
X\

 Requirement 6: Develop and maintain secure systems and applications

\DX
-291
3'3
++
2=23,
.,/.--32
-
2.%;1
1
/1.33
1.,
*-.;-
:9+-1(+(42
=
(-23++(-&
//+(+

:-.1I29//+(
291(3=
/3'2D

-23++
1(4+
291(3=
/3'2
;(3'(-
.-
,.-3'
.
1+2D

.3C
1(4+
291(3=
/3'2
2'.9+

(-4"
.1(-&
3.
3'
1(2*
1-*(-&
/1.22
"-
(-
09(1,-3
\DWD

I:F
:+./
(-31-+
-
<31-+
2.%;1
//+(4.-2
N(-+9(-&
;I2
,(-(2314:
22
3.
//+(4.-2O

291+=A
2
.++.;2C

-
.1-
;(3'



N .1
<,/+A
291
93'-44.-
-
+.&&(-&O

2
.-
(-9231=
23-12
-H.1
23
/142D

-.1/.14-&
(- .1,4.-
291(3=
3'1.9&'.93
3'
2.%;1I:+./,-3
+( 
=+

6
!"+
(($"+
,'
$$
+'1*
0$'(
"&,*&$$3
+
1$$
+
+('#
'*
/+,'%
+'1*
0$'(
3

,!"*
(*,37

Requirement 6: Develop and maintain secure systems and applications

I:G
.++.;
'-&
.-31.+
/1.222
-
/1.912
.1
++
'-&2
3.
2=23,
.,/.--32D
'
/1.222
,923
(-+9

3'
.++.;(-&C


I:G:D
/13
:+./,-3H323
-:(1.-,-32
1.,
/1.94.-
-:(1.-,-32A
-
- .1
3'
2/14.-
;(3'
22

.-31.+2D


I:G:E
/14.-
.
942
3;-
:+./,-3H323
-
/1.94.-
-:(1.-,-32


I:G:F
1.94.-
3
N+(:
2O
1
-.3
92
.1
324-&
.1
:+./,-3


I:G:G
,.:+
.
323
3
-
.9-32
 .1
/1.94.-
2=23,2
.,
4:


I:G:H
'-&
.-31.+
/1.912
.1
3'
(,/+,-34.-
.
291(3=
/3'2
-
2.%;1
,.("4.-2
,923
(-+9
3'

.++.;(-&C


I:G:H:D
.9,-34.-
.
(,/3D


I:G:H:E
.9,-3
'-&
//1.:+
=
93'.1(>
/142D


I:G:H:F
9-4.-+(3=
324-&
3.
:1( =
3'3
3'
'-&
.2
-.3
:12+=
(,/3
3'
291(3=
.
3'
2=23,D


I:G:H:G
*I.93
/1.912D

R
XVW[



- .1,4.-
91(3=

-D
X]

 Requirement 6: Develop and maintain secure systems and applications

I:H


122
.,,.-
.(-&
:9+-1(+(42
(-
2.%;1I:+./,-3
/1.222
2
.++.;2C


1(-
:+./12
(-
291
.(-&
3'-(092A
(-+9(-&
'.;
3.
:.(
.,,.-
.(-&
:9+-1(+(42A
-

9-123-(-&
'.;
2-2(4:
3
(2
'-+
(-
,,.1=D


:+./
//+(4.-2
2
.-
291
.(-&
&9(+(-2D






!
0/$&*"$"-+
$"+,
,
B7A7>
,!*'/ !
B7A7>=
1*
/**&,
1",!
"&/+,*3
+,
(*-+
1!&
,!"+
0*+"'&
'



1+
(/$"+!7
'10*5
+
"&/+,*3
+,
(*-+
'*
0/$&*"$",3
%& %&,
*
/(,
;'*
2%($5
,!


/"5
 

'(
?A5

/*
'"& 5
,7<5
,!
/**&,
+,
(*-+
%/+,

/+
'*
,!+

*)/"*%&,+7

Requirement 6: Develop and maintain secure systems and applications

I:H:D

-)4.-
$;2A
/149+1+=

(-)4.-D
+2.
.-2(1

.,,-

-)4.-A

-
3'
(-)4.-
$;2
2
;++
2

.3'1
(-)4.-
$;2D

I:H:E
9!1
.:1$.;2

I:H:F

-291
1=/3.&1/'(
23.1&

I:H:G

-291
.,,9-(4.-2

I:H:H

,/1./1
11.1
'-+(-&

I:H:I
++
F'(&'
1(2*G
:9+-1(+(42
(-4"
(-
3'
:9+-1(+(3=
(-4"4.-
/1.22
N2
"-
(-



09(1,-3
\DWOD

I:H:J
1.22I2(3
21(/4-&
NO

I:H:K

,/1./1
22
.-31.+
N29'
2
(-291
(13
.)3
1 1-2A
(+91
3.
1231(3

22A
(13.1=
31:12+A
-

(+91
3.
1231(3
921
22
3.
9-4.-2OD

R
XVW[



- .1,4.-
91(3=

-D
X^

 Requirement 6: Develop and maintain secure systems and applications

I:H:L
1.22I2(3
10923
.1&1=
NO


I:H:DC
1.*-
93'-44.-
-
222(.-
,-&,-3



)/"*%&,
B7A7>=
"+

+,
(*-
/&-$

/&
@=5
?=>A5
*
1!"!
",
'%+

*)/"*%&,7


I:I
.1
/9+(I (-&
;
//+(4.-2A
122
-;
3'132
-
:9+-1(+(42
.-
-
.-&.(-&
2(2
-
-291
3'2

//+(4.-2
1
/1.33
&(-23
*-.;-
6*2
=
(3'1
.
3'
.++.;(-&
,3'.2C


:(;(-&
/9+(I (-&
;
//+(4.-2
:(
,-9+
.1
93.,3
//+(4.-
:9+-1(+(3=
291(3=
2222,-3
3..+2

.1
,3'.2A
3
+23
--9++=
-
%1
-=
'-&2









!"+
++++%&,
"+
&',
,!
+%
+
,!
0/$&*"$",3

+&+
(*'*%
'*
)/"*%&,
>>7?7



-23++(-&
-
93.,3
3'-(+
2.+94.-
3'3
332
-
/1:-32
;I2
6*2
N .1
<,/+A

;I
//+(4.-
"1;++O
(-
1.-3
.
/9+(I (-&
;
//+(4.-2A
3.
.-4-9++=
'*
++
31#D


I:J


-291
3'3
291(3=
/.+((2
-
./14.-+
/1.912
.1
:+./(-&
-
,(-3(-(-&
291
2=23,2
-
//+(4.-2

1
.9,-3A
(-
92A
-
*-.;-
3.
++
!3
/142D

Recap
WD '3
1
3'
(!1-3
//1.'2
3.
,*

9-1+@

XD
-
319-3
-
'2'


23.1
3.&3'1@

YD '3
(2
3'
</34.-
.



1.,
91
.(-&
142@

R
XVW[



- .1,4.-
91(3=

-D
X_

 Requirement 7: Restrict access to cardholder data by business need to know

J:D
(,(3
22
3.
2=23,
.,/.--32
-
1'.+1
3
3.
.-+=
3'.2
(-(:(9+2
;'.2
).
109(12
29'
22D

J:D:D
"-
22
-2
.1
'
1.+A
(-+9(-&C


=23,
.,/.--32
-
3
12.912
3'3
'
1.+
-2
3.
22
.1
3'(1
).
9-4.-

:+
.
/1(:(+&
109(1
N .1
<,/+A
921A
,(-(2313.1A
3DO
.1
22(-&
12.912D

J:D:E
231(3
22
3.
/1(:(+&
921

2
3.
+23
/1(:(+&2
-221=
3.
/1 .1,
).
12/.-2((+(42D

J:D:F
22(&-
22
2
.-
(-(:(9+
/12.--+E2
).
+22("4.-
-
9-4.-D

J:D:G
09(1
.9,-3
//1.:+
=
93'.1(>
/142
2/( =(-&
109(1
/1(:(+&2D

Requirement 7: Restrict access to cardholder data by business need to know

J:E
23+(2'
-
22
.-31.+
2=23,
.1
2=23,2
.,/.--32
3'3
1231(32
22
2
.-

921E2
-
3.
*-.;A
-
(2

23
3.
F-=
++G
9-+22
2/("++=
++.;D

'(2
22
.-31.+
2=23,
,923
(-+9
3'
.++.;(-&C

J:E:D
.:1&
.
++
2=23,
.,/.--32

J:E:E
22(&-,-3
.
/1(:(+&2
3.
(-(:(9+2
2
.-
).
+22("4.-
-
9-4.-D

J:E:F
 9+3
F-=I++G
27-&D

J:F
-291
3'3
291(3=
/.+((2
-
./14.-+
/1.912
.1
1231(4-&
22
3.
1'.+1
3
1
.9,-3A
(-

92A
-
*-.;-
3.
++
!3
/142D

R
XVW[



- .1,4.-
91(3=

-D
YV

 Requirement 8: Identify and authenticate access to system components

K:D
"-
-
(,/+,-3
/.+((2
-
/1.912
3.
-291
/1./1
921
(-4"4.-
,-&,-3
.1
-.-I
.-29,1
9212
-
,(-(2313.12
.-
++
2=23,
.,/.--32

K:E

-
(4.-
3.
22(&-(-&

9-(09

A
-291
/1./1
921I93'-44.-
,-&,-3
.1
-.-I.-29,1
9212
-

,(-(2313.12
.-
++
2=23,
.,/.--32
=
,/+.=(-&
3
+23
.-

.
3'
.++.;(-&
,3'.2
3.
93'-43
++
9212C


.,3'(-&
=.9
*-.;A
29'
2

/22;.1
.1
/22/'12


.,3'(-&
=.9
':A
29'
2

3.*-
:(
.1
2,13
1


.,3'(-&
=.9
1A
29'
2

(.,31(

K:F

-.1/.13
3;.I 3.1
93'-44.-
.1
1,.3
-3;.1*
22
.1(&(-4-&
1.,
.932(
3'
-3;.1*
=

/12.--+
N(-+9(-&
9212
-
,(-(2313.12O
-
++
3'(1
/142A
N(-+9(-&
:-.1
22
.1
29//.13
.1

,(-3--OD

Requirement 8: Identify and authenticate access to system components

K:G
.9,-3
-
.,,9-(3
93'-44.-
/1.912
-
/.+((2
3.
++
9212
(-+9(-&C


9(-
.-
2+4-&
231.-&
93'-44.-
1-4+2


9(-
.1
'.;
9212
2'.9+
/1.33
3'(1
93'-44.-
1-4+2



-23194.-2
-.3
3.
192
/1:(.92+=
92
/22;.12



-23194.-2
3.
'-&
/22;.12
(
3'1
(2
-=
292/((.-
3'
/22;.1
.9+

.,/1.,(2D




K:H
.
-.3
92
&1.9/A
2'1A
.1
&-1(

2A
/22;.12A
.1
.3'1
93'-44.-
,3'.2
2
.++.;2C


-1(
921

2
1
(2+
.1
1,.:D


'1
921

2
.
-.3
<(23
.1
2=23,
,(-(2314.-
-
.3'1
1(4+
9-4.-2D


'1
-
&-1(
921

2
1
-.3
92
3.
,(-(231
-=
2=23,
.,/.--32D

R
XVW[



- .1,4.-
91(3=

-D
YW

 Requirement 8: Identify and authenticate access to system components

K:I
'1
.3'1
93'-44.-
,'-(2,2
1
92
N .1
<,/+A
/'=2(+
.1
+.&(+
291(3=
3.*-2A
2,13
12A

14"32A
3DOA
92
.
3'2
,'-(2,2
,923

22(&-
2
.++.;2C

93'-44.-
,'-(2,2
,923

22(&-
3.
-
(-(:(9+
.9-3
-
-.3
2'1
,.-&
,9+4/+
.9-32D

'=2(+
-H.1
+.&(+
.-31.+2
,923

(-
/+
3.
-291
.-+=
3'
(-3-
.9-3
-
92
3'3
,'-(2,
3.

&(-
22D

Requirement 8: Identify and authenticate access to system components

K:J
++
22
3.
-=
32
.-3(-(-&
1'.+1
3
N(-+9(-&
22
=
//+(4.-2A
,(-(2313.12A
-
++
.3'1

9212O
(2
1231(3
2
.++.;2C


++
921
22
3.A
921
091(2
. A
-
921
4.-2
.-
322
1
3'1.9&'
/1.&1,,4
,3'.2D


-+=
32
,(-(2313.12
':
3'
(+(3=
3.
(13+=
22
.1
091=
322D


//+(4.-

2
.1
32
//+(4.-2
-
.-+=

92
=
3'
//+(4.-2
N-
-.3
=
(-(:(9+
9212
.1
.3'1
-.-I
//+(4.-
/1.222OD




K:K
-291
3'3
291(3=
/.+((2
-
./14.-+
/1.912
.1
(-4"4.-
-
93'-44.-
1
.9,-3A
(-
92A

-
*-.;-
3.
++
!3
/142D

R
XVW[



- .1,4.-
91(3=

-D
YX

 Requirement 9: Restrict physical access to cardholder data

L:D
2
//1./1(3
(+(3=
-31=
.-31.+2
3.
+(,(3
-
,.-(3.1
/'=2(+
22
3.
2=23,2
(-
3'
1'.+1
3

-:(1.-,-3D

L:E
:+./
/1.912
3.
2(+=
(24-&9(2'
3;-
.-2(3
/12.--+
-
:(2(3.12A
3.
(-+9C

-4 =(-&
-;
.-2(3
/12.--+
.1
:(2(3.12
N .1
<,/+A
22(&-(-&
&2O

'-&2
3.
22
109(1,-32

:.*(-&
.1
31,(-4-&
.-2(3
/12.--+
-
</(1
:(2(3.1
(-4"4.-
N29'
2


&2OD

L:F
.-31.+
/'=2(+
22
.1
.-2(3
/12.--+
3.
3'
2-2(4:
12
2
.++.;2C

22
,923

93'.1(>
-
2
.-
(-(:(9+
).
9-4.-D

22
(2
1:.*
(,,(3+=
9/.-
31,(-4.-A
-
++
/'=2(+
22
,'-(2,2A
29'
2
*=2A
22
12A
3DA

1
1391-
.1
(2+D

Requirement 9: Restrict physical access to cardholder data

_DZ

,/+,-3
/1.912
3.
(-4 =
-
93'.1(>
:(2(3.12

_D[
'=2(++=
291
++
,(D

_D\
(-3(-
231(3
.-31.+
.:1
3'
(-31-+
.1
<31-+
(231(94.-
.
-=
*(-
.
,(

_D]
(-3(-
231(3
.-31.+
.:1
3'
23.1&
-
22((+(3=
.
,(D

_D^
231.=
,(
;'-
(3
(2
-.
+.-&1
-
.1
92(-22
.1
+&+
12.-2

_D_
1.33
:(2
3'3
/391
/=,-3
1
3
:(
(13
/'=2(+
(-314.-
;(3'
3'
1
1.,
3,/1(-&
-
2924394.-D

_DWV
-291
3'3
291(3=
/.+((2
-
./14.-+
/1.912
.1
1231(4-&
/'=2(+
22
3.
1'.+1
3
1
.9,-3A
(-
92A
-
*-.;-

3.
++
!3
/142D

R
XVW[



- .1,4.-
91(3=

-D
YY

 Requirement 10: Track and monitor all access to network resources and
cardholder data

DC:D

,/+,-3
9(3
31(+2
3.
+(-*
++
22
3.
2=23,
.,/.--32
3.
'
(-(:(9+
921D




DC:E

,/+,-3
93.,3
9(3
31(+2
.1
++
2=23,
.,/.--32
3.
1.-23193
3'
.++.;(-&
:-32C


DC:E:D
++
(-(:(9+
921
222
3.
1'.+1
3


DC:E:E
++
4.-2
3*-
=
-=
(-(:(9+
;(3'
1..3
.1
,(-(2314:
/1(:(+&2


DC:E:F
22
3.
++
9(3
31(+2


DC:E:G

-:+(
+.&(+
22
6,/32


DC:E
H
2
.
-
'-&2
3.
(-4"4.-
-
93'-44.-
,'-(2,2K(-+9(-&
93
-.3
+(,(3
3.
14.-
.
-;

.9-32
-
+:4.-
.
/1(:(+&2K-
++
'-&2A
(4.-2A
.1
+4.-2
3.
.9-32
;(3'
1..3
.1
,(-(2314:

/1(:(+&2


DC:E:I

-(4+(>4.-A
23.//(-&A
.1
/92(-&
.
3'
9(3
+.&2


DC:E:J
14.-
-
+4.-
.
2=23,I+:+
.)32

Requirement 10: Track and monitor all access to network resources and
cardholder data

DC:F
.1
3
+23
3'
.++.;(-&
9(3
31(+
-31(2
.1
++
2=23,
.,/.--32
.1
'
:-3C

DC:F:D
21
(-4"4.-


DC:F:E
=/
.
:-3


DC:F:F
3
-
4,


DC:F:G
922
.1
(+91
(-(4.-


DC:F:H
1(&(-4.-
.
:-3


DC:F:I

-43=
.1
-,
.
!3
3A
2=23,
.,/.--3A
.1
12.91D


DC:G
2(-&
4,I2=-'1.-(>4.-
3'-.+.&=A
2=-'1.-(>
++
1(4+
2=23,
+.*2
-
4,2
-
-291
3'3
3'

.++.;(-&
(2
(,/+,-3
.1
09(1(-&A
(231(94-&A
-
23.1(-&
4,D



&
2%($
'
-%
+3&!*'&"4-'&
,!&'$' 3
"+
,1'*#
"%
*',''$
; <7

R
XVW[



- .1,4.-
91(3=

-D
YZ

 Requirement 10: Track and monitor all access to network resources and
cardholder data

DC:H
91
9(3
31(+2
2.
3'=
--.3

+31D


DC:H:D
(,(3
:(;(-&
.
9(3
31(+2
3.
3'.2
;(3'

).I1+3
-D


DC:H:E
1.33
9(3
31(+
"+2
1.,
9-93'.1(>
,.("4.-2D


DC:H:F
1.,/3+=
*
9/
9(3
31(+
"+2
3.

-31+(>
+.&
21:1
.1
,(
3'3
(2
(#9+3
3.
+31D


DC:H:G
1(3
+.&2
.1
<31-+I (-&
3'-.+.&(2
.-3.

291A
-31+(>A
(-31-+
+.&
21:1
.1
,(
:(D

DC:H:H
2
"+I(-3&1(3=
,.-(3.1(-&
.1
'-&I34.-
2.%;1
.-
+.&2
3.
-291
3'3
<(24-&
+.&
3
--.3


'-&
;(3'.93
&-14-&
+132
N+3'.9&'
-;
3
(-&

2'.9+
-.3
92
-
+13OD

Requirement 10: Track and monitor all access to network resources and
cardholder data

DC:I
:(;
+.&2
-
291(3=
:-32
.1
++
2=23,
.,/.--32
3.
(-4 =
-.,+(2
.1
292/((.92
4:(3=D


'
!*0+-& 5
(*+"& 5
&
$*-&
,''$+
%3

/+
,'
%,
,!"+
)/"*%&,7
DC:I:D
:(;
3'
.++.;(-&
3

+23
(+=C


++
291(3=
:-32


.&2
.
++
2=23,
.,/.--32
3'3
23.1A
/1.22A
.1
31-2,(3
 
-H.1
A
.1
3'3
.9+
(,/3
3'
291(3=
.

 
-H.1



.&2
.
++
1(4+
2=23,
.,/.--32


.&2
.
++
21:12
-
2=23,
.,/.--32
3'3
/1 .1,
291(3=
9-4.-2
N .1
<,/+A
"1;++2A
(-3192(.-I34.-

2=23,2H(-3192(.-I/1:-4.-
2=23,2
N
H
OA
93'-44.-
21:12A
I.,,1
1(14.-
21:12A
3DOD


DC:I:E
:(;
+.&2
.
++
.3'1
2=23,
.,/.--32
/1(.(++=
2
.-
3'
.1&-(>4.-E2
/.+((2
-
1(2*

,-&,-3
2313&=A
2
31,(-
=
3'
.1&-(>4.-E2
--9+
1(2*
2222,-3D


DC:I:F
.++.;
9/
</4.-2
-
-.,+(2
(-4"
91(-&
3'
1:(;
/1.22D

R
XVW[



- .1,4.-
91(3=

-D
Y[

 Requirement 10: Track and monitor all access to network resources and
cardholder data

DC:J
3(-
9(3
31(+
'(23.1=
.1
3
+23
.-
=1A
;(3'

,(-(,9,
.
3'1
,.-3'2
(,,(3+=
:(++
.1

-+=2(2
N .1
<,/+A
.-+(-A
1'(:A
.1
123.1+
1.,
*9/OD

DC:K
-291
3'3
291(3=
/.+((2
-
./14.-+
/1.912
.1
,.-(3.1(-&
++
22
3.
-3;.1*
12.912

-
1'.+1
3
1
.9,-3A
(-
92A
-
*-.;-
3.
++
!3
/142D

Golden Logging Architecture

R
XVW[



- .1,4.-
91(3=

-D
Y\

 Requirement 11: Regularly test security systems and processes.

DD:D

,/+,-3
/1.222
3.
323
.1
3'
/12-
.
;(1+22
22
/.(-32
N^VXDWWOA
-
33
-
(-4 =
++

93'.1(>
-
9-93'.1(>
;(1+22
22
/.(-32
.-

09131+=
2(2D


DD:E
9-
(-31-+
-
<31-+
-3;.1*
:9+-1(+(3=
2-2
3
+23
09131+=
-
%1
-=
2(&-("-3
'-&
(-
3'

-3;.1*
N29'
2
-;
2=23,
.,/.--3
(-23++4.-2A
'-&2
(-
-3;.1*
3./.+.&=A
"1;++
19+
,.("4.-2A

/1.93
9/&12OD


DD:F

,/+,-3

,3'..+.&=
.1
/-314.-
324-&
3'3
(-+92
3'
.++.;(-&C



2
2
.-
(-9231=I/3
/-314.-
324-&
//1.'2
N .1
<,/+A


^VVIWW[O



-+92
.:1&
.1
3'
-41

/1(,31
-
1(4+
2=23,2



-+92
324-&
1.,
.3'
(-2(
-
.932(
3'
-3;.1*



-+92
324-&
3.
:+(3
-=
2&,-34.-
-
2./I194.-
.-31.+2


"-2
//+(4.-I+=1
/-314.-
3232
3.
(-+9A
3

,(-(,9,A
3'
:9+-1(+(42
+(23
(-
09(1,-3
\D[


"-2
-3;.1*I+=1
/-314.-
3232
3.
(-+9
.,/.--32
3'3
29//.13
-3;.1*
9-4.-2
2
;++
2
./14-&

2=23,2



-+92
1:(;
-
.-2(14.-
.
3'132
-
:9+-1(+(42
</1(-
(-
3'
+23
WX
,.-3'2


/("2
13-4.-
.
/-314.-
324-&
129+32
-
1,(4.-
4:(42
129+32D

Requirement 11: Regularly test security systems and processes.

DD:F

,/+,-3

,3'..+.&=
.1
/-314.-
324-&
3'3
(-+92
3'
.++.;(-&C



2
2
.-
(-9231=I/3
/-314.-
324-&
//1.'2
N .1
<,/+A


^VVIWW[O



-+92
.:1&
.1
3'
-41

/1(,31
-
1(4+
2=23,2



-+92
324-&
1.,
.3'
(-2(
-
.932(
3'
-3;.1*



-+92
324-&
3.
:+(3
-=
2&,-34.-
-
2./I194.-
.-31.+2


"-2
//+(4.-I+=1
/-314.-
3232
3.
(-+9A
3

,(-(,9,A
3'
:9+-1(+(42
+(23
(-
09(1,-3
\D[


"-2
-3;.1*I+=1
/-314.-
3232
3.
(-+9
.,/.--32
3'3
29//.13
-3;.1*
9-4.-2
2
;++
2
./14-&

2=23,2



-+92
1:(;
-
.-2(14.-
.
3'132
-
:9+-1(+(42
</1(-
(-
3'
+23
WX
,.-3'2


/("2
13-4.-
.
/-314.-
324-&
129+32
-
1,(4.-
4:(42
129+32D

R
XVW[



- .1,4.-
91(3=

-D
Y]

 Requirement 11: Regularly test security systems and processes.

DD:G
2
(-3192(.-I34.-
-H.1
(-3192(.-I/1:-4.-
3'-(092
3.
33
-H.1
/1:-3
(-3192(.-2
(-3.
3'

-3;.1*D
.-(3.1
++
31#
3
3'
/1(,31
.
3'
1'.+1
3
-:(1.-,-3
2
;++
2
3
1(4+
/.(-32
(-
3'

1'.+1
3
-:(1.-,-3A
-
+13
/12.--+
3.
292/3
.,/1.,(22D

/
++
(-3192(.-I34.-
-
/1:-4.-
-&(-2A
2+(-2A
-
2(&-3912
9/
3.
3D

DD:H
/+.=

'-&I34.-
,'-(2,
N .1
<,/+A
"+I(-3&1(3=
,.-(3.1(-&
3..+2O
3.
+13
/12.--+
3.

9-93'.1(>
,.("4.-
.
1(4+
2=23,
"+2A
.-"&914.-
"+2A
.1
.-3-3
"+2B
-
.-"&91
3'
2.%;1
3.

/1 .1,
1(4+
"+
.,/1(2.-2
3
+23
;*+=D

DD:I
-291
3'3
291(3=
/.+((2
-
./14.-+
/1.912
.1
291(3=
,.-(3.1(-&
-
324-&
1
.9,-3A
(-
92A

-
*-.;-
3.
++
!3
/142D

Recap
WD (1;++
(2
109(1
3.

1:(;
:1=
LLLLLLLLLLD

XD LLLLLLLLLLLL
(2
++.;
3.

23.1
(-


.1
+&(4,3
92(-22
109(1,-3D

YD -4:(192
2.%;1
(2
109(1
3.

(,/+,-3
(-
LLLLLLLLLLLLLLLD

ZD 9(3
1(+
(2
109(1
3.

23.1
.1

/1(.
.
LLLLLLLLL

[D <31-+
-2
1
109(1
3.

.-
LLLLLLLLLLLLD

\D +:-3
/3'2
1
109(1
3.
(-23++
LLLLLLLLLLLD

R
XVW[



- .1,4.-
91(3=

-D
Y^

 Requirement 12: Maintain a policy that addresses information security for all
personnel.

DE:D
23+(2'A
/9+(2'A
,(-3(-A
-
(22,(-3

291(3=
/.+(=D

DE:D:D
:(;
3'
291(3=
/.+(=
3
+23
--9++=
-
9/3
3'
/.+(=
;'-
3'
-:(1.-,-3
'-&2D

DE:E

,/+,-3

1(2*I2222,-3
/1.22
3'3C

2
/1 .1,
3
+23
--9++=
-
9/.-
2(&-("-3
'-&2
3.
3'
-:(1.-,-3
N .1
<,/+A
09(2(4.-A
,1&1A

1+.4.-A
3DOA

-4"2
1(4+
2232A
3'132A
-
:9+-1(+(42A
-

29+32
(-

.1,+
1(2*
2222,-3D

2%($+
'
*"+#:++++%&,
%,!''$' "+
"&$/
/,
*
&',
$"%",
,'
5

?C==A
&


D==:@=7

Requirement 12: Maintain a policy that addresses information security for all
personnel.

DE:F
:+./
92&
/.+((2
.1
1(4+
3'-.+.&(2
-
"-
/1./1
92
.
3'2
3'-.+.&(2D


2%($+
'
*"-$
,!&'$' "+
"&$/5
/,
*
&',
$"%",
,'5
*%',
++
&
1"*$++
,!&'$' "+5
$(,'(+5

,$,+5
*%'0$
$,*'&"
%"5
:%"$
/+ 
&
&,*&,
/+ 7

-291
3'2
92&
/.+((2
109(1
3'
.++.;(-&C


DE:F:D
</+((3
//1.:+
=
93'.1(>
/142


DE:F:E
93'-44.-
.1
92
.
3'
3'-.+.&=


DE:F:F

+(23
.
++
29'
:(2
-
/12.--+
;(3'
22


DE:F:G

,3'.
3.
913+=
-
1(+=
31,(-
.;-1A
.-33
(- .1,4.-A
-
/91/.2
N .1
<,/+A
++(-&A

.(-&A
-H.1
(-:-3.1=(-&
.
:(2O


DE:F:H
/3+
922
.
3'
3'-.+.&=

R
XVW[



- .1,4.-
91(3=

-D
Y_

 Requirement 12: Maintain a policy that addresses information security for all
personnel.

DE:F:I
/3+
-3;.1*
+.4.-2
.1
3'
3'-.+.&(2

DE:F:J
(23
.
.,/-=I//1.:
/1.932

DE:F:K
93.,4
(2.--3
.
222(.-2
.1
1,.3I22
3'-.+.&(2
%1

2/("
/1(.
.
(-4:(3=

DE:F:L
4:4.-
.
1,.3I22
3'-.+.&(2
.1
:-.12
-
92(-22
/13-12
.-+=
;'-
-
=
:-.12
-

92(-22
/13-12A
;(3'
(,,(3
4:4.-
%1
92

DE:F:DC
.1
/12.--+
22(-&
1'.+1
3
:(
1,.3I22
3'-.+.&(2A
/1.'((3
3'
./=(-&A
,.:(-&A
-

23.1&
.
1'.+1
3
.-3.
+.+
'1
1(:2
-
1,.:+
+31.-(
,(A
9-+22
</+((3+=
93'.1(>
.1


"-
92(-22
-D

'1
3'1
(2
-
93'.1(>
92(-22
-A
3'
92&
/.+((2
,923
109(1
3'
3

/1.33
(-
.1-
;(3'
++

//+(+



09(1,-32D

Requirement 12: Maintain a policy that addresses information security for all
personnel.

DE:G
-291
3'3
3'
291(3=
/.+(=
-
/1.912
+1+=
"-
(- .1,4.-
291(3=
12/.-2((+(42
.1
++
/12.--+D

DE:H
22(&-
3.
-
(-(:(9+
.1
3,
3'
.++.;(-&
(- .1,4.-
291(3=
,-&,-3
12/.-2((+(42C

DE:H:D
23+(2'A
.9,-3A
-
(231(93
291(3=
/.+((2
-
/1.912D

DE:H:E
.-(3.1
-
-+=>
291(3=
+132
-
(- .1,4.-A
-
(231(93
3.
//1./1(3
/12.--+D

DE:H:F
23+(2'A
.9,-3A
-
(231(93
291(3=
(-(-3
12/.-2
-
2+4.-
/1.912
3.
-291
4,+=
-

!4:
'-+(-&
.
++
2(394.-2D

DE:H:G
,(-(231
921
.9-32A
(-+9(-&
(4.-2A
+4.-2A
-
,.("4.-2D

DE:H:H
.-(3.1
-
.-31.+
++
22
3.
3D

DE:I

,/+,-3

.1,+
291(3=
;1-22
/1.&1,
3.
,*
++
/12.--+
;1
.
3'
(,/.13-
.
1'.+1
3

291(3=D

R
XVW[



- .1,4.-
91(3=

-D
ZV

 Requirement 12: Maintain a policy that addresses information security for all
personnel.

DE:I:D
93
/12.--+
9/.-
'(1
-
3
+23
--9++=D



,!'+
&
0*3
(&"&
'&
,!
*'$
'
,!
(*+'&&$
&
,!"*
$0$
'
++
,'
,!
*!'$*
,7


WXD\DX
09(1
/12.--+
3.
*-.;+&
3
+23
--9++=
3'3
3'=
':
1
-
9-123..
3'
291(3=
/.+(=
-

/1.912D

DE:J
1-
/.3-4+
/12.--+
/1(.1
3.
'(1
3.
,(-(,(>
3'
1(2*
.
6*2
1.,
(-31-+
2.912D
N<,/+2
.

*&1.9-
'*2
(-+9
/1:(.92
,/+.=,-3
'(23.1=A
1(,(-+
1.1A
1(3
'(23.1=A
-
1 1-
'*2DO



'*
,!'+
(',&-$
(*+'&&$
,'

!"*
'*
*,"&
('+"-'&+
+/!
+
+,'*
+!"*+
1!'
'&$3
!0
++
,'
'&
*

&/%*
,

-%
1!&
"$",-&

,*&+-'&5
,!"+
*)/"*%&,
"+

*'%%&-'&
'&$37

DE:K
(-3(-
-
(,/+,-3
/.+((2
-
/1.912
3.
,-&
21:(
/1.:(12
;(3'
;'.,
1'.+1
3
(2
2'1A

.1
3'3
.9+
!3
3'
291(3=
.
1'.+1
3A
2
.++.;2C

DE:K:D
(-3(-

+(23
.
21:(
/1.:(12D

Requirement 12: Maintain a policy that addresses information security for all
personnel.

DE:K:E
(-3(-

;1(6-
&1,-3
3'3
(-+92
-
*-.;+&,-3
3'3
3'
21:(
/1.:(12
1
12/.-2(+
.1
3'

291(3=
.
1'.+1
3
3'
21:(
/1.:(12
/.2222
.1
.3'1;(2
23.1A
/1.22
.1
31-2,(3
.-
'+
.
3'

923.,1A
.1
3.
3'
<3-3
3'3
3'=
.9+
(,/3
3'
291(3=
.
3'
923.,1E2
1'.+1
3
-:(1.-,-3D


!
2,
1'*"&
'
&
#&'1$ %&,
1"$$
(&
'&
,!
 *%&,
,1&
,!
,1'
(*-+5
,!
,"$+
'
,!

+*0"
"&
(*'0"5
&
,!
*+('&+""$"-+
++" &
,'
!
(*,37
!
#&'1$ %&,
'+
&',
!0
,'
"&$/
,!

2,
1'*"&
(*'0"
"&
,!"+
*)/"*%&,7

DE:K:F
-291
3'1
(2
-
23+(2'
/1.22
.1
-&&(-&
21:(
/1.:(12
(-+9(-&
/1./1
9
(+(&-
/1(.1
3.

-&&,-3D

DE:K:G
(-3(-

/1.&1,
3.
,.-(3.1
21:(
/1.:(12E



.,/+(-
23392
3
+23
--9++=D

R
XVW[



- .1,4.-
91(3=

-D
ZW

 Requirement 12: Maintain a policy that addresses information security for all
personnel.

DE:K:H
(-3(-
(- .1,4.-
.93
;'('



109(1,-32
1
,-&
=
'
21:(
/1.:(1A
-
;'('
1

,-&
=
3'
-43=D


DE:L





9
1:(
/1.:(12
*-.;+&
(-
;1(4-&
3.
923.,12
3'3
3'=
1

12/.-2(+
.1
3'
291(3=
.
1'.+1
3
3'
21:(
/1.:(1
/.22222
.1
.3'1;(2
23.12A
/1.222A
.1
31-2,(32

.-
'+
.
3'
923.,1A
.1
3.
3'
<3-3
3'3
3'=
.9+
(,/3
3'
291(3=
.
3'
923.,1E2
1'.+1
3

-:(1.-,-3D



!"+
*)/"*%&,
"+

+,
(*-
/&-$

/&
@=5
?=>A5
*
1!"!
",
'%+

*)/"*%&,7



!
2,
1'*"&
'
&
#&'1$ %&,
1"$$
(&
'&
,!
 *%&,
,1&
,!
,1'
(*-+5
,!
,"$+
'
,!

+*0"
"&
(*'0"5
&
,!
*+('&+""$"-+
++" &
,'
!
(*,37
!
#&'1$ %&,
'+
&',
!0
,'
"&$/
,!

2,
1'*"&
(*'0"
"&
,!"+
*)/"*%&,7

Requirement 12: Maintain a policy that addresses information security for all
personnel.

DE:DC

,/+,-3
-
(-(-3
12/.-2
/+-D

/1/1
3.
12/.-
(,,(3+=
3.

2=23,
1'D

DE:DC:D
13
3'
(-(-3
12/.-2
/+-
3.

(,/+,-3
(-
3'
:-3
.
2=23,
1'D
-291
3'
/+-
1222

3'
.++.;(-&A
3

,(-(,9,C

.+2A
12/.-2((+(42A
-
.,,9-(4.-
-
.-33
2313&(2
(-
3'
:-3
.

.,/1.,(2
(-+9(-&
-.4"4.-
.

3'
/=,-3
1-2A
3

,(-(,9,

/("
(-(-3
12/.-2
/1.912

92(-22
1.:1=
-
.-4-9(3=
/1.912

3
*9/
/1.222

-+=2(2
.
+&+
109(1,-32
.1
1/.14-&
.,/1.,(22

.:1&
-
12/.-22
.
++
1(4+
2=23,
.,/.--32

 1-
.1
(-+92(.-
.
(-(-3
12/.-2
/1.912
1.,
3'
/=,-3
1-2D

R
XVW[



- .1,4.-
91(3=

-D
ZX

 Requirement 12: Maintain a policy that addresses information security for all
personnel.

DE:DC:E
23
3'
/+-
3
+23
--9++=D

DE:DC:F
2(&-3
2/("
/12.--+
3.

:(++
.-

XZH]
2(2
3.
12/.-
3.
+132D

DE:DC:G
1.:(
//1./1(3
31(-(-&
3.
23!
;(3'
291(3=
1'
12/.-2
12/.-2((+(42D

DE:DC:H

-+9
+132
1.,
291(3=
,.-(3.1(-&
2=23,2A
(-+9(-&
93
-.3
+(,(3
3.
(-3192(.-I34.-A
(-3192(.-I
/1:-4.-A
"1;++2A
-
"+I(-3&1(3=
,.-(3.1(-&
2=23,2D

DE:DC:I
:+./

/1.22
3.
,.( =
-
:.+:
3'
(-(-3
12/.-2
/+-
.1(-&
3.
+22.-2
+1-
-
3.

(-.1/.13
(-9231=
:+./,-32D

PCI Success Plan*

WD 3
'(&'23
+:+
.
2/.-2.12'(/
.1
3'
/1.&1,

XD 3
3'
1(&'3
3,H/./+
'(-
3'
/1.&1,

YD 93

/1./1
/1.)3
/+-
-
9&3
29#(-3
4,
3.
&3
(3
1(&'3

ZD .-93
Y
3=/2
.
31(-(-&C

D 


31(-(-&
.1
(,/+,-312

D 


31(-(-&
.1
(2(.-
,*12

D 


31(-(-&
.1
:+./12

[D 14.-
.

1.22
9-4.-+


31(-&
.,,(6


\D
-4 =
1'.+1
3
(-
3'
-:(1.-,-3

P
<313
.
3'




922
+-

R
XVW[



- .1,4.-
91(3=

-D
ZY

 PCI Success Plan*
]D .-93



(2*
2222,-3

^D .-93
2+
2222,-3
.-
I
.1
1(4+
//+(4.-2
3
3'
1+(23

_D /2
(2922(.-
-
&1,-3
3;-

-
(-31-+
23*'.+12

WVD ,(4.-
2
/1
3'
/+-
-
(- .1,
*=
23*'.+12
.
-=
+=

WWD 1(.(
231(-&
.,,(6
,4-&2
3.
3*
(2(.-2

WXD (+23.-
1:(;
++2
3.
(2922
3'-(+
'++-&2
-
&1,-3
;(3'


P
<313
.
3'




922
+-

THANK YOU


Q

D





   











R
XVW[



- .1,4.-
91(3=

-D
ZZ