Blog  PCI DSS 3.1: In Review of the Old Standard

The PCI DSS is a set of security standards created by the Payment Card Industry Security Standards Council (PCI SSC). The council was formed by the major credit card companies (Visa, MasterCard, Discover, American Express, and JCB) in 2006 to establish a common set of security standards for businesses that process credit card payments.

As of January 1, 2016, all organizations that process credit card payments had to comply with the PCI DSS 3.1 standard. That included new requirements for encryption of credit card data and improved security around authentication. Version 3.1 included new requirements for the encryption of credit card data and improved security around authentication.

The PCI DSS has been updated several times since its inception, most recently in 2022 with version 4.0. (Link to New Standard)

Organizations that process credit card payments must comply with the PCI DSS to be able to accept credit cards from customers. Failure to comply with the PCI DSS can result in fines from the credit card companies or even being banned from processing credit card payments altogether.

What were the requirements for PCI DSS 3.1?

The PCI DSS 3.1 standard included 12 requirements to be met to be compliant. These requirements are grouped into six categories, which are listed below:

1. Build and Maintain a Secure Network
2. Protect Cardholder Data
3. Maintain a Vulnerability Management Program
4. Implement Strong Access

Control Measures

5. Monitor and Test Networks
6. Maintain an Information Security Policy

PCI DSS 3.1: Detailed Overview of the Requirements

1. Build and Maintain a Secure Network

This requirement includes ensuring that all systems are adequately protected from malware and unauthorized access and having a firewall in place to protect data.

2. Protect Cardholder Data

This requirement includes ensuring that all credit card data is encrypted, both in transit and the rest.

In addition, organizations must also ensure that they have implemented proper security controls to prevent the unauthorized disclosure of credit card data.

3. Maintain a Vulnerability Management Program

This requirement includes ensuring that all systems are appropriately patched and that vulnerabilities are being monitored on an ongoing basis.

4. Implement Strong Access Control Measures

This requirement includes ensuring that all users have the proper permissions to access data and that there are controls in place to prevent unauthorized access.

5. Monitor and Test Networks

This requirement includes ensuring that networks are being monitored for unusual activity and that regular penetration testing is conducted.

6. Maintain an Information Security Policy

This requirement includes having a written security policy that covers all aspects of information security.

Organizations that process credit card payments must comply with the newest PCI DSS standard to be able to accept credit cards from customers. Failure to comply with the PCI DSS can result in fines from the credit card companies or even being banned from processing credit card payments altogether.

If you’re not already compliant with PCI DSS, now is the time to get started. The sooner you can become compliant, the better off you’ll be.

The PCI DSS is a complex standard, and compliance can be a challenge for organizations. However, there are many resources available to help businesses understand and implement the requirements of the PCI DSS.

The best way to ensure compliance with the PCI DSS is to work with a qualified security professional who can assess your organization’s specific needs and help you develop a plan to meet the standard’s requirements. 

Contact us today if you’re looking for more information on PCI DSS compliance or need help getting started. We’ll be happy to answer any of your questions and get you started on the path to compliance. Read our blog to know more about what’s new in PCI DSS v 4.0.