PCI DSS

1. PCI DSS standard

   PCI DSS v4.0.1 requirements and testing procedures.

2. Scope and CDE

   Cardholder data environment, account data elements (PAN, CVV, track data) and network segmentation.

3. Requirements 1 and 2

   Network security controls and secure configurations.

4. Requirements 3 and 4

   Protect stored account data (truncation, hashing, strong cryptography, key management) and encrypt transmission.

5. Requirements 5 and 6

   Malware protection, secure software development, patching and web application protection.

6. Requirements 7 to 9

   Need-to-know access, authentication including MFA, and physical access.

7. Requirements 10 and 11

   Log monitoring, time sync, vulnerability scanning, penetration testing and file integrity monitoring.

8. Requirement 12

   Security policies, risk assessments, incident response and third-party service provider management.

9. Validation and SAQs

   Merchant levels, ROC vs SAQ types and attestation of compliance.

10. FAQs

    Clarifications on scoping, tokenization, cloud and customized approach.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.

Source: endoflife.date