Payment card industry compliance standards

If you accept and process card transactions, there are 12 basic requirements which apply to you:

1. install and maintain a firewall configuration to protect cardholder data
2. don’t use vendor-supplied defaults for system passwords and other security parameters
3. protect stored cardholder data
4. encrypt transmission of cardholder data across open public networks.
5. use and regularly update anti-virus software or programs
6. develop and maintain secure systems and applications 
7. restrict access to cardholder data by business need-to-know
8. assign a unique ID to each person with computer access
9. restrict physical access to cardholder data
10. track and monitor all access to network resources and cardholder data.
11. regularly test security systems and processes
12. maintain a policy that addresses information security for employees and contractors.

You can read more about the basic standards on the PCI DSS website.

To see if you meet PCI DSS requirements, you may need to complete one or more of the following validation tasks:

1. complete the PCI DSS self-assessment questionnaire (SAQ)
2. complete a vulnerability scan via an approved scanning vendor (ASV)
3. perform an on-site assessment.

The number of validations tasks you are required to complete depends on your merchant level. Merchant levels as defined by Mastercard and Visa as captured in the below table:

Once you have completed the validation requirements, keep a copy of the PCI assessment/certificates in a secure location. We may reach out for evidence at various times as a condition of you holding a merchant terminal from us.

For more information on how to maximise the security of cardholder data, please visit the PCI DSS website.

Visa and Mastercard have published resources on how to keep up to date with security standards and best practices. We recommend reviewing these resources to help with PCI DSS compliance and implementation:

Mastercard website

Visa website