Pci Dss 3.0 Requirement 1

Front 1

1.1

Back 1

Establish and implement firewall and router configuration standards that formalize testing whenever configurations change; that identify all connections between the cardholder data environment and other networks (including wireless) with documentation and diagrams; that document business justification and various technical settings for each implementation; that diagram all cardholder data flows across systems and networks; and stipulate a review of configuration rule sets at least every six months.

Front 2

1.2

Back 2

Build firewall and router configurations that restrict all traffic, inbound and outbound, from "untrusted” networks (including wireless) and hosts, and specifically deny all other traffic except for protocols necessary for the cardholder data environment.

Front 3

1.3

Back 3

Prohibit direct public access between the Internet and any system component in the cardholder data environment.

Front 4

1.4

Back 4

Install personal firewall software on any mobile and/or employee-owned devices that connect to the Internet when outside the network, and which are also used to access the network.

Front 5

1.5

Back 5

Ensure that related security policies and operational procedures are documented, in use, and known to all affected parties.

Front 6

2.1

Back 6

Always change ALL vendor-supplied defaults and remove or disable unnecessary default accounts before installing a system on the network. This includes wireless devices that are connected to the cardholder data environment or are used to transmit cardholder data.

Front 7

2.2

Back 7

Develop configuration standards for all system components that address all known security vulnerabilities and are consistent with industry-accepted definitions. Update system configuration standards as new vulnerability issues are identified.

Front 8

2.3

Back 8

Using strong cryptography, encrypt all non-console administrative access such as browser/webbasedmanagement tools.

Front 9

2.4

Back 9

Maintain an inventory of system components that are in scope for PCI DSS.

Front 10

2.5

Back 10

Ensure that related security policies and operational procedures are documented, in use, and known to all affected parties.

Front 11

2.6

Back 11

Shared hosting providers must protect each entity’s hosted environment and cardholder data (details are in PCI DSS Appendix A: “Additional PCI DSS Requirements for Shared Hosting Providers.”)