What is PCI DSS?
PCI DSS Requirements are a set of twelve technical and operational standards designed to protect cardholder data and prevent fraud.
These requirements are organized into six overarching principles, including building and maintaining a secure network, protecting account data, maintaining a vulnerability management program, implementing strong access control measures, regularly monitoring and testing networks, and maintaining an information security policy.
First introduced in 2004, PCI DSS applies to all entities involved in payment card environments, including merchants, processors, acquirers, issuers, and service providers handling cardholder data for the major credit card schemes.
This is part of a series of articles about
PCI DSS compliance.
In this article:
The PCI DSS framework is built on 12 foundational requirements to create a layered security approach for payment card data environments. These requirements encompass everything from network and system security to policy and staff training, forming a coherent structure to reduce risk from multiple angles.
Each requirement is broad but underpinned by specific sub-controls and detailed guidance. Collectively, they address technical exposures, operational weaknesses, and human factors in payment environments. The following sections break down each requirement, explaining its intent, core controls, and significance for PCI DSS compliance.
Requirement 1: Network Security Controls and Firewalls
This requirement mandates that organizations install, configure, and maintain network security controls, such as firewalls or equivalent technologies, to protect cardholder data environments from unauthorized access and external threats. The goal is to create physical and logical segmentation between public networks (such as the Internet) and systems that store or process cardholder data.
Best practices for compliance:
- Deploy firewalls or equivalent network security controls at all perimeter and internal boundaries
- Define and document rules for allowed and denied traffic
- Restrict inbound and outbound access to only what is necessary for business operations
- Regularly review and test firewall and router configurations
- Maintain up-to-date network diagrams and data flow diagrams
- Segment cardholder data environment (CDE) from untrusted networks
- Secure wireless networks with encryption and strong authentication
Requirement 2: Secure Configurations and No Vendor Defaults
Organizations must avoid using default passwords, security parameters, or settings on any system components within the cardholder data environment. Default settings are widely known and easily exploitable, so all devices, systems, and applications must be hardened using secure configurations tailored to the organization’s risks and operational requirements.
Best practices for compliance:
- Change all vendor-supplied defaults before system installation
- Disable or remove unnecessary services and accounts
- Use configuration standards based on industry best practices (e.g., CIS Benchmarks)
- Regularly review and validate secure configuration baselines
- Apply configuration management tools to enforce consistent hardening
- Limit administrative access and require secure authentication for management interfaces
Requirement 3: Protecting Stored Cardholder Data
This requirement focuses on minimizing the storage of cardholder data and ensuring that if it must be retained, it is rendered unreadable to unauthorized individuals. Controls include strong encryption of all stored cardholder data, truncation and masking of primary account numbers (PAN), and strict processes for data retention and deletion. Only entities with valid business needs may store cardholder information, and data must be disposed of securely when no longer required.
Best practices for compliance:
- Minimize data storage to the least amount necessary for business
- Use strong cryptography (e.g., AES-256) to encrypt stored cardholder data
- Mask PAN when displayed (e.g., show only last 4 digits)
- Document and enforce retention and disposal policies
- Store encryption keys securely and separate from encrypted data
- Monitor access to sensitive data and encryption systems
Requirement 4: Strong Cryptography in Data Transmission
PCI DSS mandates that cardholder data transmitted across open, public networks must be protected by strong encryption and secure protocols. Technologies such as TLS (transport layer security) are required for all transmissions over the internet or between untrusted networks. Weak or obsolete protocols such as SSL and early versions of TLS must not be used, and clear documentation must map data flows, encryption solutions, and key management processes.
Best practices for compliance:
- Use strong encryption (e.g., TLS 1.2 or higher) for all transmissions over public networks
- Avoid deprecated protocols such as SSL and early TLS
- Validate the effectiveness and configuration of encryption tools
- Maintain current documentation of all data flows involving cardholder data
- Secure wireless transmissions using WPA2 or stronger, and require authentication
- Monitor and alert on unauthorized or unencrypted data transfers
Requirement 5: Anti-Malware and System Protection
Organizations must deploy anti-malware solutions across all systems, particularly those commonly affected by malicious software. Automated updates, continuous monitoring, and regular scanning help maintain the effectiveness of these controls in blocking known threats. PCI DSS also requires organizations to document and review the effectiveness of anti-malware safeguards and to adapt them as new attack techniques emerge.
Best practices for compliance:
- Install anti-malware software on all systems commonly affected by malware
- Enable automatic updates and real-time scanning
- Schedule regular malware scans and generate reports for review
- Document and assess the effectiveness of anti-malware tools
- Implement compensating controls for systems not supporting traditional anti-malware
- Train users to recognize and report potential malware threats
Requirement 6: Secure Development and Patch Management
PCI DSS requires organizations to establish secure software development practices and promptly apply critical security patches to all system components. This includes using secure coding standards, reviewing code for vulnerabilities, and performing security testing throughout the software lifecycle. Developers must be trained on secure development, and organizations must track and address new vulnerabilities as they are discovered.
Best practices for compliance:
- Follow secure coding standards (e.g., OWASP, SEI CERT)
- Conduct code reviews and automated security testing
- Apply security patches promptly, especially for critical vulnerabilities
- Maintain a vulnerability management program to identify and address new threats
- Document change management and testing procedures
- Provide secure development training for developers and testers
Requirement 7: Access Controls Based on Business Need
This requirement enforces the principle of least privilege within the cardholder data environment. Access to systems and data must be limited strictly according to business requirements, ensuring that only authorized personnel can perform tasks relevant to their roles. Access rights must be formally approved, documented, and reviewed regularly to prevent privilege creep or the retention of access by former employees.
Best practices for compliance:
- Define and document access requirements based on role and business function
- Use role-based access control (RBAC) to enforce least privilege
- Approve and review access rights periodically
- Revoke access immediately upon employee termination or role change
- Enforce separation of duties for sensitive operations
- Maintain audit logs of access provisioning and changes
Requirement 8: Authentication and Unique Identification
All users, whether employees, contractors, or vendors, must be uniquely identified and authenticated before accessing any cardholder data systems. Multi-factor authentication (MFA) is required for remote access and for all users in environments where cardholder data is accessible. Unique IDs (not shared accounts) enable accountability and ensure actions can be traced to individual users.
Best practices for compliance:
- Assign unique IDs to every user with system access
- Enforce password complexity and change requirements
- Use multi-factor authentication (MFA) for remote and administrative access
- Prohibit the use of shared, group, or generic accounts
- Lock accounts after repeated failed login attempts
- Regularly review authentication mechanisms for effectiveness
Requirement 9: Physical Security of Cardholder Data
PCI DSS addresses the risk of physical compromise through the requirement for strong physical access controls. This means restricting entry to sensitive areas, securing servers and media, and using access logs to monitor who enters and exits locations where cardholder data can be accessed or stored. Surveillance cameras, access badges, visitor logs, and locked containers are among the expected controls.
Best practices for compliance:
- Restrict physical access to CDEs to authorized personnel only
- Implement access controls such as key cards, badges, or biometric systems
- Use surveillance cameras to monitor sensitive areas
- Secure media containing cardholder data in locked cabinets or safes
- Maintain visitor logs and verify identity before granting access
- Conduct periodic physical security reviews and remove outdated access rights
Requirement 10: Logging and Monitoring Access
Organizations handling cardholder data must implement logging and monitoring of access to the cardholder data environment. Audit trails should capture all access, changes, and privileged operations, enabling the timely detection of suspicious activity or policy violations. Ensuring logs are tamper-proof and regularly reviewed helps organizations spot incidents early and supports forensic investigations.
Best practices for compliance:
- Enable detailed logging of access, changes, and administrative actions
- Use centralized log servers and SIEM tools for aggregation and analysis
- Review logs daily for critical systems and incidents
- Protect logs from unauthorized access and tampering
- Retain logs for at least 12 months, with three months immediately available
- Set alerts for key security events, such as failed logins or privilege escalation
Requirement 11: Regular Testing of Systems and Processes
To ensure controls are effective, PCI DSS requires organizations to regularly test network defenses, system components, and operational processes. This includes running internal and external vulnerability scans, penetration testing, and the use of file integrity monitoring solutions to detect unauthorized changes. The goal is to proactively identify gaps or weaknesses before attackers can exploit them.
Best practices for compliance:
- Perform quarterly internal and external vulnerability scans
- Conduct annual penetration testing or after significant changes
- Implement file integrity monitoring to detect unauthorized changes
- Use automated tools to validate system configurations and defenses
- Track and remediate vulnerabilities in a timely manner
- Document testing results and remediation efforts for audit purposes
Requirement 12: Information Security Policies and Governance
A documented information security policy is the backbone of PCI DSS compliance. The policy must be communicated to all relevant staff and address security roles, responsibilities, and procedures for maintaining the security of cardholder data environments. Senior management must be engaged to provide oversight and ensure resources are allocated appropriately.
Best practices for compliance:
- Develop and maintain a formal, documented security policy
- Ensure the policy is reviewed annually and updated as needed
- Communicate security roles and responsibilities to all staff
- Provide regular security awareness training for employees
- Maintain an incident response plan and test it at least annually
- Include third-party service providers in risk and compliance assessments
Failing to comply with PCI DSS carries immediate and long-term risks. In the event of a payment card data breach, organizations may face financial penalties from payment brands, remediation costs for investigations and restitution, and the expense of credit monitoring for affected customers. Serious cases can lead to the suspension or revocation of payment processing rights.
Longer-term consequences include reputational harm, legal action from customers or partners, and persistent increased scrutiny from regulatory bodies. The public disclosure of non-compliance is likely to erode customer trust and can drive away business, making recovery difficult.
Uri Dorot
Uri Dorot is a senior product marketing manager at Radware, specializing in application protection solutions, service and trends. With a deep understanding of the cyber threat landscape, Uri helps companies bridge the gap between complex cybersecurity concepts and real-world outcomes.
Tips from the Expert:
In my experience, here are tips that can help you better leverage WAAP solutions:
1. Use edge-based rate limiting for API protection: Implement rate limiting at the edge of your network rather than at the application layer. This reduces the risk of DDoS attacks overwhelming your backend systems and ensures quicker response times for legitimate users.
2. Use content-aware DLP (Data Loss Prevention) within WAAP: Integrate content-aware DLP to monitor API traffic for sensitive data leakage. This prevents unintended data exposure, particularly in scenarios where APIs handle sensitive PII, financial, or healthcare data.
3. Implement API sandboxing for untrusted requests: Route untrusted or anomalous API requests through an API sandbox before processing them. This containment strategy helps mitigate risks from unvalidated inputs, preventing potential exploits from reaching your core application logic.
4. Integrate WAAP with SIEM for enhanced visibility: Connect your WAAP logs with a Security Information and Event Management (SIEM) system. This integration enhances threat detection and provides a consolidated view of application security events, helping identify complex attack patterns across multiple layers.
5. Enable TLS inspection for comprehensive protection: Ensure that WAAP solutions are configured to decrypt and inspect HTTPS traffic. Attackers often hide malicious payloads within encrypted traffic, and without TLS inspection, these threats may bypass standard detection mechanisms.
By adopting the following guidelines, organizations can make it easier to comply with and maintain PCI DSS requirements.
1. Maintain and Test Firewalls Regularly
Organizations must establish and maintain firewalls and network security controls that segment cardholder data from less secure environments. Firewall rules must be documented, reviewed, and tested at regular intervals to ensure only necessary network traffic is allowed.
Regular penetration testing, vulnerability scanning, and change management reviews are critical. These confirm that firewalls remain effective as network environments evolve.
2. Implement Strong Authentication Mechanisms
Strong authentication goes beyond simple passwords. Organizations should adopt multi-factor authentication (MFA) for all access to cardholder data systems, especially for remote users and administrators. Each user must have a unique ID, and shared accounts should be eliminated to ensure accountability.
Password complexity, rotation policies, and automatic session timeouts also contribute to robust authentication. Regular audits of authentication systems are necessary to detect weaknesses or unauthorized access.
3. Encrypt All Sensitive Data in Storage and Transit
All payment card data must be protected using industry-approved encryption at rest and in transit. Solutions must use strong algorithms and keys, with processes for secure key management, periodic rotation, and limiting access to cryptographic resources. Encryption should be applied end-to-end, including for data stored in backups or transmitted over internal and external networks.
Regular reviews of encryption implementations and strategies for minimizing clear-text data exposure help reduce opportunities for data theft.
4. Limit Access Based on Least Privilege
Organizations should only grant access to cardholder systems and data on a strict need-to-know basis. Access privileges must be aligned with specific job roles and reviewed regularly to identify and remove unused or excessive permissions. Automated provisioning and deprovisioning can ensure timely updates when staff roles change.
Documenting access requests and ensuring approvals are consistently recorded increases control over who can interact with sensitive payment data.
5. Establish Continuous Monitoring and Auditing
Continuous monitoring tools are necessary to detect and respond to suspicious activities promptly. SIEM platforms and real-time alerting systems should aggregate logs from all relevant sources, including firewalls, servers, applications, and endpoints. Automated alerts for anomalous behavior enable rapid investigation and response.
Frequent auditing of logs and security events should be part of regular operations. Scheduled reviews and custom threat detection rules help organizations adapt to new attack techniques and regulatory expectations.
6. Keep All Systems Patched and Updated
Maintaining up-to-date systems is critical for closing security gaps exploited in payment card breaches. Organizations need structured patch management processes to quickly identify, test, and deploy patches for vulnerabilities in operating systems, applications, and network devices. Delays in patching can leave organizations exposed.
Change control processes, combined with automated vulnerability scanning and patch deployment tools, help ensure timely updates and reduce the risk of missing critical fixes.
7. Conduct Regular Training for Staff
Security awareness is a core requirement for PCI DSS and a foundational element of strong payment card data protection. Regular, role-appropriate training educates staff on handling cardholder data securely, recognizing potential threats, and responding to security incidents. Training content should be updated to reflect new risks, such as social engineering tactics or phishing attempts.
Organizations should document participation and effectiveness of security training, linking it to overall compliance and risk mitigation goals.
Supporting PCI DSS Compliance with Radware
Radware provides a comprehensive solution suite that help ensure compliance with stringent new PCI DSS 4 compliance and customer security requirements:
Cloud Application Protection Services
Radware’s Cloud Application Protection Services provide a unified solution for comprehensive web application and API protection, bot management, client-side protection, and application-level DDoS protection. Leveraging Radware SecurePath™, an innovative API-based cloud architecture, it ensures consistent, top-grade security across any cloud environment with centralized visibility and management. This service protects digital assets and customer data across on-premise, virtual, private, public, and hybrid cloud environments, including Kubernetes. It addresses over 150 known attack vectors, including the OWASP Top 10 Web Application Security Risks, Top 10 API Security Vulnerabilities, and Top 21 Automated Threats to Web Applications. The solution employs a unique positive security model and machine-learning analysis to reduce exposure to zero-day attacks by 99%. Additionally, it distinguishes between “good” and “bad” bots, optimizing bot management policies to enhance user experience and ROI. Radware’s service also ensures reduced latency, no route changes, and no SSL certificate sharing, providing increased uptime and seamless protection as businesses grow and evolve.
Cloud WAF
Radware’s Alteon Integrated WAF ensures fast, reliable and secure delivery of mission-critical Web applications and APIs for corporate networks and in the cloud. Recommended by the NSS, certified by ICSA Labs, and PCI compliant, this WAF solution combines positive and negative security models to provide complete protection against web application attacks, access violations, attacks disguised behind CDNs, API manipulations, advanced HTTP attacks (such as slowloris and dynamic floods), brute force attacks on log-in pages and more.
Bot Manager
Radware Bot Manager is a multiple award-winning bot management solution designed to protect web applications, mobile apps, and APIs from the latest AI-powered automated threats. Utilizing advanced techniques such as Radware’s patented Intent-based Deep Behavior Analysis (IDBA), semi-supervised machine learning, device fingerprinting, collective bot intelligence, and user behavior modeling, it ensures precise bot detection with minimal false positives. Bot Manager provides AI-based real-time detection and protection against threats such as ATO (account takeover), DDoS, ad and payment fraud, and web scraping. With a range of mitigation options (like Crypto Challenge), Bot Manager ensures seamless website browsing for legitimate users without relying on CAPTCHAs while effectively thwarting bot attacks. Its AI-powered correlation engine automatically analyzes threat behavior, shares data throughout security modules and blocks bad source IPs, providing complete visibility into each attack.
Account Takeover (ATO) Protection
Radware Bot Manager protects against Account Takeover attacks, and offers robust protection against unauthorized access to user accounts across web portals, mobile applications, and APIs. Utilizing advanced techniques such as Intent-based Deep Behavior Analysis (IDBA), semi-supervised machine learning, device fingerprinting, and user behavior modeling, it ensures precise bot detection with minimal false positives. The solution provides comprehensive defense against brute force and credential stuffing attacks, and offers flexible bot management options including blocking, CAPTCHA challenges, and feeding fake data. With a scalable infrastructure and a detailed dashboard, Radware Bot Manager delivers real-time insights into bot traffic, helping organizations safeguard sensitive data, maintain user trust, and prevent financial fraud.
API Protection
Radware’s API Protection solution is designed to safeguard APIs from a wide range of cyber threats, including data theft, data manipulation, and account takeover attacks. This AI-driven solution automatically discovers all API endpoints, including rogue and shadow APIs, and learns their structure and business logic. It then generates tailored security policies to provide real-time detection and mitigation of API attacks. Key benefits include comprehensive coverage against OWASP API Top 10 risks, real-time embedded threat defense, and lower false positives, ensuring accurate protection without disrupting legitimate operations.
Client-Side Protection
Radware’s Client-Side Protection solution is designed to secure end users from attacks embedded in the application supply chain, such as Magecart, formjacking, and DOM XSS. It provides continuous visibility into third-party scripts and services running on the browser side of applications, ensuring real-time activity tracking and threat-level assessments. This solution complies with PCI-DSS 4.0 requirements, helping to protect sensitive customer data and maintain organizational reputation. Key features include blocking untrusted destinations and malicious scripts without disrupting legitimate JavaScript services, monitoring HTTP headers and payment pages for manipulation attempts, and providing end-to-end protection against supply chain exploits.