01
Secure network
Use appropriate network boundaries and secure configurations to reduce unnecessary exposure.
SECURITY / PCI DSS
Keep card payment handling aligned with security controls.
Understand the security controls and operational practices around payment data.
Security practices should match the payment environment and scope.
PAYMENT SECURITYCONTROL AREAS
Data protectionSafeguards in place
Control reviewDefined responsibilities
ProtectCardholder information
ControlSystems and access
ReviewSecurity practices
KEY CONTROL AREASSecurity is a practice.
Security is a practice.
Not a one-time checkbox.
PCI DSS-related work involves multiple areas of protection. The relevant requirements depend on your environment, payment flows and scope.
02
Protect cardholder data
Apply safeguards to cardholder data and limit its exposure throughout the payment journey.
03
Vulnerability management
Maintain secure systems and review relevant weaknesses, updates and configuration changes.
04
Access control
Grant access according to role and business need, with suitable authentication and oversight.
05
Monitor and test
Review security activity and test relevant safeguards as part of ongoing operations.
06
Security policies
Document responsibilities and maintain repeatable security practices across teams.
A SCOPE-AWARE APPROACHUnderstand the scope.
Understand the scope.
Strengthen the controls.
Start with how cardholder data is handled, which systems are involved and who is responsible for each control. Use that view to plan reviews and improvements.
Discuss your environmentSECURITY WORKFLOW
01MapUnderstand the payment flow and systems in scope.
02AssessIdentify relevant controls and responsibilities.
03ProtectApply safeguards appropriate to the environment.
04ReviewMaintain evidence and reassess changes over time.
Illustrative planning flow; it does not establish PCI DSS compliance.
SUPPORTING PRACTICESKeep responsibilities
Keep responsibilities
clear and reviewable.
Defined ownership, useful records and ongoing reviews help teams maintain security practices as payment systems change.
Document
Keep policies, responsibilities and operating procedures current.
Restrict
Limit access to systems and information according to business need.
Monitor
Review relevant events and investigate exceptions appropriately.
Reassess
Revisit controls when payment flows, systems or providers change.
PAYMENT SECURITY
Contact our team Need to discuss your card payment environment?
Talk with our team about payment flows, integration responsibilities and security requirements.