PCI-DSS 2.0：支付卡行业数据安全标准详解

需积分: 9 105 浏览量更新于2024-07-30 收藏 1.29MB PDF 举报

PCI DSS（Payment Card Industry Data Security Standard）是一项由Payment Card Industry Security Standards Council（PCI SSC）制定并维护的数据安全标准，旨在确保处理信用卡交易的商家和服务提供商能够妥善保护客户的支付卡信息，防止数据泄露和欺诈。该标准于2010年发布了其第二版（Version 2.0），相较于之前的版本，进行了多项重要改进。在PCI DSS Version 2.0中，关键变化包括： 1. **文档整合与一致性**（October 2008 - 1.2 版本）：为了消除文档间的冗余，并对PCIDSS Security Audit Procedures v1.1进行了调整，将通用和具体要求统一到一个名为“PCIDSS Requirements and Security Assessment Procedures”的文档中。同时，提供了从v1.1到v1.2的详细变化概述，以便用户了解更新内容。 2. **修正错误和澄清**： - 在测试程序6.3.7中的“then”被误删，已修正为“than”。 - 对灰色标记的“inplace”和“notinplace”列在测试步骤6.5.b中进行了调整，可能涉及列目的或呈现方式的修改。 - 补偿控制工作表示例的顶部措辞被纠正，明确了该表格用于定义通过补偿控制来满足未实施要求的情况。 3. **明确指导**：对于Compensating Controls Worksheet，工作表的使用说明得到了修正，强调了它是用来定义任何标记为“inplace”要求的补偿控制的工具。这些更改体现了PCI DSS对数据安全的持续关注和对合规性的强化，确保所有参与方能够按照最新的最佳实践进行操作，降低风险，保护消费者和商户免受潜在的安全威胁。遵循PCI DSS标准是金融机构、电子商务网站和其他涉及信用卡交易处理的组织的法定责任，违反可能导致重大的财务罚款和声誉损害。因此，企业必须定期审查和更新其安全措施，以保持符合PCI DSS的最新规定。

PCI DSS Requirements and Security Assessment Procedures, Version 2.0 October 2010

 If there are no standard PCI DSS processes/controls in place and each business facility/system component is managed through non-

standard processes, the sample must be larger for the assessor to be assured that each business facility/system component has

implemented PCI DSS requirements appropriately.

For each instance where sampling is used, the assessor must:

 Document the rationale behind the sampling technique and sample size,

 Document and validate the standardized PCI DSS processes and controls used to determine sample

size, and

 Explain how the sample is appropriate and representative of the overall population.

Assessors must revalidate the sampling rationale for each assessment. If sampling is to be used, different

samples of business facilities and system components must be selected for each assessment.

Compensating Controls

On an annual basis, any compensating controls must be documented, reviewed and validated by the assessor and included with the Report on

Compliance submission, per Appendix B: Compensating Controls and Appendix C: Compensating Controls Worksheet.

For each and every compensating control, the Compensating Controls Worksheet (Appendix C) must be completed. Additionally, compensating

control results should be documented in the ROC in the corresponding PCI DSS requirement section.

See the above-mentioned Appendices B and C for more details on ―compensating controls.‖

Please also refer to:

Appendix D: Segmentation

and Sampling of Business

Facilities/System

Components.

PCI DSS Requirements and Security Assessment Procedures, Version 2.0 October 2010

2. Description of Scope of Work and Approach Taken

Describe the scope, per the Scope of Assessment section of this document, including the following:

 Document how the assessor validated the accuracy of the PCI DSS scope for the assessment, including:

- The methods or processes used to identify and document all existences of cardholder data

- How the results were evaluated and documented

- How the effectiveness and accuracy of the methods used were verified

- That the assessor validates that the scope of the assessment is accurate and appropriate.

 Environment on which assessment focused (for example, client’s Internet access points, internal corporate network, processing

connections)

 If network segmentation is in place and was used to reduce scope of the PCI DSS review, briefly explain that segmentation and

how assessor validated the effectiveness of the segmentation

 If sampling is used during the assessment, for each sample set selected (of business facilities/system components) document the

following:

- Total population

- Number sampled

- Rationale for sample selected

- Description of the standardized PCI DSS security and operational processes and controls used to determine sample size, and

how the processes/controls were validated

- How the sample is appropriate and representative of the overall population

- Description of any locations or environments that store, process, or transmit cardholder data that were EXCLUDED from the

scope of the review, and why these locations/environments were excluded

 List any wholly-owned entities that require compliance with the PCI DSS, and whether they are reviewed separately or as part of

this assessment

 List any international entities that require compliance with the PCI DSS, and whether they are reviewed separately or as part of this

assessment

 List any wireless LANs and/or wireless payment applications (for example, POS terminals) that are connected to, or could impact

the security of the cardholder data environment, and describe security in place for these wireless environments

 The version of the PCI DSS Requirements and Security Assessment Procedures document used to conduct the assessment

剩余74页未读，继续阅读

aiachris2k1

粉丝: 0
资源: 1

PCI-DSS 2.0：支付卡行业数据安全标准详解

Payment_card_industry_data_security_standard_handbook.pdf

Sustainable Compliance for the Payment Card Industry Data Security Standard

什么是SSI和QSSI

数通中基线和合规都是什么意思

滴滴公司的安全资源有哪些

pci规划 python

基于外部法规视角，两大行业标准

网络安全其它行业标准介绍

信息安全技术规范有哪些

PCI DSS 与 ISO27001联系与区别

最新资源