PCI DSS

International security standards (norms) – they prevent information leak of vulnerable card holders data and also prevent against card frauds caused by illegal miss-usage of these data
Basically, there are 12 requirements
Security requirements are specified for organization which process, transmit or store card holders or payment transactions data (particularly banks, authorization offices, service providers, merchants accepting payment cards)
It includes specific security recommendations how to protect payment cards and card holders data
- Security compliance should be and will be regularly audited within all subjects working with payment cards information, audit level depends on a quantity and a type of payment transactions per year
- Security treatments for payment card data are, within banks and specialized organization (also authorized centres), secured and audited, this is also needed for other concerned subjects
- Security treatments for payment card data at the services providers and merchants must be also checked and its subject to listed standards:
  - annual audit can only be processed by qualified auditors
  - quarterly external vulnerability testing can only be processed by approved vendors
  - Self-Assessment SAQ can be processed by concerned subject/ merchant them self
for further details please see www.pcisecuritystandards.org or www.pcistandard.cz