PCI Requirements

A PCI Compliance Checklist

If your business accepts credit cards and other types of payments cards, you may have heard about something called PCI compliance. Payment card industry compliance (PCI compliance) is the meeting of guidelines developed by the PCI Security Standards Council, an open worldwide body formed to focus on payment card data protection during and following transactions. This article will explain the basics of getting started with becoming PCI compliant.

The PCI council builds and distributes payment standards while helping organizations learn how to meet them. It publishes resources, including self-assessment questionnaires, certification procedures, and training parameters.[i]

  • Installed and properly configured routers and firewalls
  • Replacement of all default passwords
  • Defenses on any PCI information in storage
  • Encryption of data transmission on any public networks
  • Regularly used & updated antivirus
  • Maintenance of secure software and systems
  • Business need-to-know access control
  • Unique IDs for everyone with access
  • Stringent physical access controls
  • Network and data access monitoring & tracking
  • Testing of all security mechanisms
  • Information security policy


The founding members of the body are Visa Inc., MasterCard, Discover Financial Services, American Express, and JCB International. All these companies have integrated the PCI Data Security Standards (PCI-DSS) within their own security programs.

PCI-DSS compliance validation is managed by each different payment company (Visa, MasterCard, and the other founding members). Each of them also trusts the authority of Approved Scanning Vendors and Qualified Security Assessors that have met the expectations of the PCI council.

The security standards council is not involved with compliance enforcement. That role is carried out by the payment card firms or acquiring financial institutions.

PCI data security guidelines

Payment security is critical for any merchant, bank, or organization that handles cardholder information. The PCI-DSS requirements are designed to keep data safe and away from unauthorized parties. They establish how an entity can approach payment transactions from operational and technical perspectives. They also provide a structure with which manufacturers and developers can build security into their technology.[ii]

Basic Elements of PCI Compliance

Maintenance of Network Security

  • Deployment of firewalls to prevent intrusion into data
  • Changing of default passwords provided by vendors

Safeguarding of Cardholder Details

  • Blocking of access to cardholder information
  • Encryption of all data during transmission

Establishment of a Vulnerability Management Plan

  • Keeping an antivirus solution updated, and using it consistently
  • Creation and evolution of software and system security

Adherence to Access Control Best Practices

  • Following of a need-to-know policy for transaction data
  • Designation of individual login credentials for every user
  • Limiting access within the physical environment

Monitoring and Testing of the Network

  • Oversight for any data and network access
  • Ongoing, periodic testing of all security aspects

Implementation of a Data Security Policy

  • Creation of a policy that contains expectations related to data safety for an organization’s staff, as well as third parties.

PIN Transaction Security

The PCI PIN Transaction Security (PCI PTS) guidelines are meant to protect devices that process or contain consumer PIN data and other transaction information. Companies that manufacture devices used in payments should meet this standard when they create, build, and ship their products.

Payment Application Data Security Standard

This rule, the Payment Application Data Security Standard (PA-DSS), applies to application developers or anyone else who creates programs involved in payment card information storage, processing, or transmission. This standard applies, for instance, to the sale, distribution, and licensure of transaction-related software.

Point-to-Point Encryption

This part of the standards is focused on validating tasks completed by vendors that provide point-to-point (P2P) encryption. When a P2P encryption product meets these compliance specifications, merchants can know that cybercriminals won’t be able to read any information they might intercept.

Simple step-by-step security framework

The PCI Data Security Standard, developed using the expertise of security personnel from entities across the planet, should not be oversimplified. Below, we will explore more thoroughly how to establish PCI compliance, but this checklist is a good start:

  • Purchase and install point-of-sale (POS) PIN entry devices that are validated to have met the requirements of the PCI council.
  • Only use transaction applications, at POS and online, that are validated.
  • Stop storing payments details either digitally or as hard copies.
  • Set up firewalls.
  • Use passwords and encryption for your Wi-Fi router.
  • Make sure all passwords are complex and that none are defaults.
  • Scan PCs and PIN devices for malicious applications.
  • Train your personnel on data standards.
  • Align your organization with all PCI-DSS guidelines.

How to meet PCI compliance standards

If you want to protect your payment data, monitor to ensure that you are meeting all the PCI DSS controls. It’s key that your efforts at compliance are continual, rather than checking for it only once per year. An annual assessment that you meet the standards is insufficient: the controls in place at entities that previously completed assessments often don’t meet compliance at the time of a breach. Compliance is, instead, a year-round endeavor – as indicated by the three-step model created by the council.[iii]

Three-step model for ongoing compliance

PCI compliance is not linear but moves in a continual circle, transitioning repeatedly through these three stages:

Assessment: Through scoping, note card data that must be protected, and recognize technology and operations involved in transactions. Assess these elements for vulnerability.
Remediation: Solve any vulnerability issues and offload any sensitive data you don’t need.
Reporting: Create and send necessary documentation to payment card firms and merchant acquirers.


To put the PCI Data Security Standard into action at your organization, you must perform scoping. Scoping is a process through which you create an inventory of every element that is inside or linked to your transaction data system. It must take place once per year, in advance of your assessment.

For comprehensive scoping, organizations that want to achieve compliance should be aware of everywhere payment data exists, as well as how it is transmitted.


Data security companies that are approved by the PCI council are called qualified security assessors.

An assessor completes the following tasks and expectations for validation of compliance:

  • Confirms technical details provided by services or merchants
  • Determines whether the entity is compliant based on their own understanding of the standards
  • Offers expert advice and support
  • Is physically present during the assessment as is necessary
  • Meets the requirements of the assessment practices outlined by the PCI council
  • Verifies the assessment’s scope
  • Assesses compensating controls
  • Creates compliance reports


Reporting is an essential element of PCI compliance. It is the official manner through which a merchant or other organization notifies the payment card companies and acquiring banks of their efforts at compliance.

It may also be necessary to submit a quarterly report detailing the findings of a network scan. Payment card firms will sometimes want you to complete and submit other paperwork as well. Examples include the self-assessment questionnaire (when evaluating your own system) and report on compliance (when having a third party assess your system).

Self-assessment questionnaire

The self-assessment questionnaire (SAQ) is typically used by entities that do not need to send in a report on compliance. It is a robust method to validate your own security stance.

The SAQ is very straightforward, made up of a list of yes-or-no questions intended to evaluate compliance with each PCI DSS element. Whenever one of the parameters is not met, the entity may have to set a date for remediation and related tasks.

Various types of questionnaire exist for use by the full spectrum of entities that need to meet compliance.

You can easily find the self-assessment questionnaire that best describes how you accept payment cards. If you are not sure which questionnaire applies to you, contact your acquiring bank or payment card brand for assistance. They are all detailed in the Self-Assessment Questionnaire PDF available through the PCI Council’s website.

Compliance with the Payment Card Industry Data Security Standard is not only important internally but with your hosting partners as well. Do you need a PCI-compliant hosting environment? Atlantic.Net’s Data Centers are routinely inspected and are fully audited and SOC 2 TYPE II and SOC 3 TYPE II certified. Learn more.

[i] https://www.pcisecuritystandards.org/about_us/

[ii] https://www.pcisecuritystandards.org/pci_security/maintaining_payment_security

[iii] https://www.pcisecuritystandards.org/pci_security/how

Our Technology Partners

HIPAA Partners

A Support Team Backed
by Decades of Experience

With over two decades of experience, our support team is always here to assist you. You'll have 24/7/365 access to a crop of dedicated veterans, capable of solving any technical problem you throw their way.

Email Support


Phone Support


Cloud Hosting

Hosting Available in Multiple Data Centers

International Cloud Data Center Locations

Award-Winning Service

Award-Winning Service
Contact Us

Share your vision with us, and we will develop a hosting environment tailored to your needs!

Contact an advisor at 888-618-DATA (3282) or fill out the form below.

Get Help with HIPAA Compliance

Atlantic.Net stands ready to help you attain fast compliance with a range of certifications, such as SOC 2 and SOC 3, HIPAA, and HITECH, all with 24x7x365 support, monitoring, and world-class data center infrastructure. For faster application deployment, free IT architecture design, and assessment, call 888-618-DATA (3282), or email us at [email protected].

Atlantic.Net in the News

Featured Logos

Clients Served

PUMA Logos
Samsung Logos
Viacom Logos
Kia Logos
Lenovo Logos
Hilton Logos
iHeart Logos
Orlando Magic Logos
NASA Logos
Newegg Logos

New York, NY

100 Delawanna Ave, Suite 1

Clifton, NJ 07014

United States

San Francisco, CA

2820 Northwestern Pkwy,

Santa Clara, CA 95051

United States

Dallas, TX

2323 Bryan Street,

Dallas, Texas 75201

United States

Ashburn, VA

1807 Michael Faraday Ct,

Reston, VA 20190

United States

Orlando, FL

440 W Kennedy Blvd, Suite 3

Orlando, FL 32810

United States

Toronto, Canada

20 Pullman Ct, Scarborough,

Ontario M1X 1E4


London, UK

14 Liverpool Road, Slough,

Berkshire SL1 4QZ

United Kingdom