PCI DSS Requirements & Implementation Flashcards

How many core requirements does PCI DSS contain?

Answer: 12 requirements organized into 6 goals

PCI DSS contains 12 core requirements organized under 6 goals: build/maintain secure network, protect cardholder data, maintain vulnerability management, implement access controls, monitor/test networks, and maintain security policies.

What is the purpose of network segmentation in PCI compliance?

Answer: To isolate the cardholder data environment from the rest of the network, reducing the scope of PCI assessment

Network segmentation isolates systems that process cardholder data, reducing the number of systems subject to PCI requirements and the attack surface available to threat actors.

What is a Self-Assessment Questionnaire (SAQ) in PCI compliance?

Answer: A validation tool for merchants and service providers to self-evaluate their compliance with PCI DSS

SAQs allow smaller merchants to self-assess their PCI compliance status based on their specific payment processing methods, with different SAQ types for different processing environments.

What data elements must be protected under PCI DSS?

Answer: Primary Account Number (PAN), cardholder name, expiration date, and service code

PCI DSS requires protection of the PAN (which must be rendered unreadable when stored), cardholder name, expiration date, and service code, with sensitive authentication data never stored after authorization.

What encryption standards does PCI DSS require for transmitting cardholder data?

Answer: Strong cryptography protocols like TLS 1.2+ for data in transit over public networks

PCI DSS requires strong cryptographic protocols (TLS 1.2 or higher) when transmitting cardholder data across open, public networks to prevent interception by unauthorized parties.

What are the consequences of PCI DSS non-compliance?

Answer: Fines from card brands, increased transaction fees, liability for breach costs, and potential loss of card processing privileges

Non-compliance consequences include monthly fines ($5,000-$100,000), increased per-transaction fees, liability for fraud losses and breach costs, and potential termination of the ability to accept card payments.