PCI DSS Best Practices in 2024

Deploying automated tests to protect against current threats

Managing the attack surface and security risks comprehensively and preventively

Defining the frequency of assessments

Protecting sensitive authentication data (SAD) and the primary account number (PAN)

Implementing appropriate cryptographic mechanisms

Implementing stronger authentication mechanisms

Reviewing and enhancing access control in user accounts and application and system accounts

Having stricter incident response programs

Having updated and more complete security awareness programs

Maintain an inventory of custom software and third-party software components to facilitate vulnerability and patch management. (6.3.2)

Perform automated antimalware scans when removable electronic media is inserted, connected or logically mounted. (5.3.3)

Implement processes and automated mechanisms to detect phishing attacks and defend against them. (5.4.1)

Deploy an automated technical solution that continually detects and prevents web-based attacks. (6.4.2)

Use automated mechanisms to perform audit log review. (10.4.1.1)

Deploy a mechanism to detect unauthorized changes on HTTP headers and contents of payment pages at least once every seven days or when required per the targeted analysis. (11.6.1)

Use intrusion-detection and or intrusion-prevention techniques to detect, alert on/prevent and address covert communications with command-and-control systems. (11.5.1.1) (This one is directed at service providers only.)

Perform vulnerability scans enabled by credentials and sufficient privileges, and document the systems where authenticated scanning is not possible. (11.3.1.2)

Manage vulnerabilities that are not considered as high-risk or critical per the company's targeted risk analysis. (11.3.1.1)

Support customer requests to conduct penetration testing or for penetration testing results. (11.4.7) (This one is directed at service providers.)

Review the effectiveness of logical separation via penetration testing at least once every six months. (A1.1.4) (This one is directed at service providers.)

Support decisions on how frequently requirements must be performed with targeted risk analyses reviewed at least once every 12 months. (12.3.1)

Review hardware and software technologies in use at least once every 12 months to define whether they meet the security needs and are still supported by the vendor, and document the course of action to remediate outdated technologies. (12.3.4)

Document and confirm the scope of the PCI DSS review at least once every six months and upon significant changes. (12.5.2.1)

Document and communicate to management a review of the impact to PCI DSS scope and applicability of controls upon significant changes to organizational structure (e.g., company mergers or acquisitions). (12.5.3)

Define the frequency of periodic malware scans. (5.3.2.1)

Define the frequency of evaluations of system components identified as not at risk for malware. (5.2.3.1)

Perform a targeted risk analysis to define the frequency of log reviews for system components for which a daily log review is not mandatory. (10.4.2.1)

Perform a targeted risk analysis to define the frequency of periodic point-of-interaction device inspections and the type of inspections. (9.5.1.2.1)

Keep to a minimum the storage of SAD prior to completion of authorization. (3.2.1)

Prevent PAN from being copied or relocated by unauthorized personnel using remote-access technologies (e.g., virtual desktops). (3.4.2)

Confirm that certificates used to safeguard PAN during transmission over open, public networks are valid and not expired or revoked. (4.2.1)

Maintain an inventory of trusted keys and certificates used to protect PAN during transmission. (4.2.1.1)

Document all payment page scripts that are loaded and executed in the consumer's browser with their justification and implement methods to confirm each script is authorized and assure each script's integrity. (6.4.3)

Document that the use of the same cryptographic keys in production and test environments is prevented. (3.6.1.1) (This is directed at service providers.)

Use strong cryptography to encrypt SAD that is stored prior to completion of authorization. (3.3.2)

Use strong cryptography to encrypt SAD. (3.3.3) (This one is directed at issuers.)

Use keyed cryptographic hashes of the entire PAN to render PAN unreadable. (3.5.1.1)

Use disk-level and partition-level encryption on removable electronic media (e.g., bulk tape-backups) to render PAN unreadable. (3.5.1.2)

Inventory cryptographic cipher suites and protocols in use at least once every 12 months, review their continued viability and devise a course of action for when they become deprecated. (12.3.3)

If authentication for user accounts is through passwords or passphrases, they must be at least 12 characters long (if the system cannot support this, then the minimum is 8 characters) and have both numeric and alphabetic characters. (8.3.6)

Rotate passwords/passphrases for application and system accounts periodically and have them be complex. (8.6.3)

Require passwords/passphrases be changed at least once every 90 days or analyze in real time the security posture of user accounts. (8.3.10.1) (This one is directed at service providers.)

Implement MFA for all access into the cardholder data environment. (8.4.2) (Does not apply to user accounts on point-of-sale terminals.)

Require success of all authentication factors to grant access, have them be at least two factors and use controls so they cannot be bypassed nor are susceptible to replay attacks. (8.5.1)

Limit access of application and system accounts to only the systems, applications or processes necessary and apply the principle of least privilege. (7.2.5)

Review periodically application and system accounts and related access privileges. (7.2.5.1)

Prevent interactive login and document when it is permitted, requiring explicit approval by management, usage only for the time necessary, confirming user identity before access and allowing attribution to this individual user. (8.6.1)

Prevent having passwords or passphrases for any application and system account that can be used for interactive login hard coded in scripts, configuration/property files or source code. (8.6.2)

Review at least once every six months all user accounts and related access privileges. (7.2.4)

Implement logical separation so that, unless authorized, the provider cannot access its customers' environments and vice versa. (A1.1.1) (This one is directed at service providers.)

Detect, alert and promptly address failures of critical security control systems. (10.7.2)

Respond fast, restore security functions and implement controls to prevent reoccurrence. (10.7.3)

Detect, alert and promptly address failures of automated audit log review mechanisms and code review tools. (A3.3.1) (Directed at entities required by payment brands or acquirers to undergo further assessments due to, e.g., a history of repeated breaches of account data.)

Have procedures of incident response for when PAN is stored where it is not expected, including finding out where it came from and how it got where it is. (12.10.7)

Include that alerts from a change and tamper-detection mechanism for payment pages are monitored and responded to. (12.10.5)

Implement secure methods for customers to report security incidents and vulnerabilities, and address each report. (A1.2.3) (This one is directed at service providers.)

Perform a targeted risk analysis to define the frequency of training for incident response personnel. (12.10.4.1)

Include content about the acceptable use of end-user technologies. (12.6.3.2)

Include phishing and other social engineering-related attacks. (12.6.3.1)

Review the program at least once every 12 months to keep it up-to-date on any new threats or vulnerabilities. (12.6.2)