PCI DSS FUNDAMENTALS
This council, formed by Visa, MasterCard, Discover, JCB International, and American Express, developed the PCI DSS.
What is the PCI Security Standards Council (PCI SSC)?
This up-to-19-digit number is the defining factor in whether PCI DSS requirements apply to stored, processed, or transmitted data.
What is the primary account number (PAN)?
This core principle's requirements include installing a firewall configuration and not using vendor-supplied default passwords.
What is 'build and maintain a secure network and systems'?
This document is the culmination of an on-site compliance assessment conducted by a QSA or ISA.
What is the Report on Compliance (ROC)?
This individual, certified by the PCI SSC, is trained to conduct formal assessments of an organization's PCI DSS compliance.
What is a Qualified Security Assessor (QSA)?
This is the version of PCI DSS, published in March 2022, that introduced clearer structure and technology-neutral language.
What is PCI DSS version 4.0?
Created in 1954, this modulo-10 algorithm is used to validate credit cards and other identification numbers.
What is the Luhn algorithm?
This requirement mandates multifactor authentication for all remote network access and a maximum 15-minute inactivity timeout.
What is 'identify and authenticate access to system components'?
Merchants not required to undergo an on-site assessment may instead complete this self-assessment validation tool.
What is the Self-Assessment Questionnaire (SAQ)?
This type of professional investigates payment card security incidents to determine how a breach occurred and its extent.
What is a PCI Forensic Investigator (PFI)?
This term describes treating PCI controls as part of an ongoing, risk-based strategy rather than a point-in-time determination.
What is 'business as usual'?
Unlike cardholder data, this category — including full magnetic stripe data, CVV2, and PIN blocks — may never be stored after authorization, even encrypted.
What is sensitive authentication data?
This requirement calls for strong cryptography in transit and forbids sending unprotected PANs by email, chat, or text.
What is 'encrypt transmission of cardholder data across open, public networks'?
This SAQ type applies only to e-commerce merchants that outsource all payment processing to a PCI DSS–validated third party.
What is SAQ A-EP?
Under the Fair Credit Billing Act, this is the maximum consumer liability for unauthorized use if a credit card itself is lost or stolen.
What is $50?
Incorporated as an appendix in PCI DSS v3.2, this document lists supplemental validation criteria for designated entities.
What is DESV (Designated Entities Supplemental Validation)?
This practice of attaching a fraudulent card-reading device to a terminal or ATM steals cardholder data and PINs.
What is skimming?
This requirement calls for retaining audit logs for at least one year, with three months immediately available for analysis.
What is 'track and monitor all access to network resources and cardholder data'?
A merchant processing more than 6 million Visa transactions annually falls into this compliance validation level.
What is Level 1?
Under the EFTA, if a debit or ATM card loss is reported more than 60 days after a bank statement is sent, the consumer bears this share of liability.
What is full (unlimited) liability?
PCI DSS is organized around six core principles supported by this many top-level requirements.
What is 12?
Physically or logically isolating the cardholder data environment from the rest of the network to reduce PCI scope is known as this.
What is segmentation?
This final, broadly scoped requirement calls for an annually reviewed cybersecurity policy covering all the other 11 requirements.
What is 'maintain a policy that addresses cybersecurity for all personnel'?
This organization, approved by the PCI SSC, is required to perform quarterly external vulnerability scans for entities with externally facing IPs.
What is an Approved Scanning Vendor (ASV)?
Fines for a card data compromise, imposed on the issuing bank and passed down to the merchant, may reach up to this amount per incident.
What is $500,000?