How to Achieve Compliance With Payment Card Industry (PCI) Data Protection Clauses and Protect Against Data Breaches

Overview

With the severity of recent data breaches, anxiety in the security and compliance community has reached a new high. Questions are being asked about what it means to be PCI compliant, particularly in the context of protecting data from data breaches. This paper describes two PCI requirements for cardholder data protection: data auditing and data encryption. As mandated by PCI 10, data auditing should provide for detailed monitoring of all access to the card holder as well as alerting on potential data theft. As mandated by PCI 3, data encryption should be used to render cardholder data unreadable to anyone who is not authorized. While these two capabilities are distinct, they can be synergistic.