Data security compliance

• 1. Install and maintain a firewall configuration to protect cardholder data
• 2. Do not use vendor-supplied defaults for system passwords and other security parameters. 

• 3. Protect stored cardholder data
• 4. Encrypt transmission of cardholder data across open, public networks 

• 5. Protect all systems against malware and regularly update anti-virus software or programmes
• 6. Develop and maintain secure systems and applications.

• 7. Restrict access to cardholder data by business need-to-know
• 8. Identify and authenticate access to system components
• 9. Restrict physical access to cardholder data 

• 10. Track and monitor all access to network resources and cardholder data
• 11. Regularly test security systems and processes 

• 12. Maintain a policy that addresses information security for all personnel

Every year:

• File a Report on Compliance ("ROC") by Qualified Security Assessor ("QSA")” or Internal Auditor if signed by officer of the company. We recommend the internal auditor obtain the PCI SSC Internal Security Assessor ("ISA") certification.
• Submit an Attestation of Compliance ("AOC") Form
  

Every quarter:

• Conduct a quarterly network scan by an Approved Scan Vendor ("ASV") 

Every year:

• Complete a Self-Assessment Questionnaire ("SAQ")
• Submit an Attestation of Compliance ("AOC") Form
  

Every quarter:

• Conduct a quarterly network scan by an Approved Scan Vendor ("ASV") 

Every year:

• Complete a Self-Assessment Questionnaire ("SAQ")
• Submit an Attestation of Compliance ("AOC") Form
  

Every quarter:

• Conduct a quarterly network scan by an Approved Scan Vendor ("ASV") 

Every year:

• Complete a Self-Assessment Questionnaire ("SAQ")
  
• Submit an Attestation of Compliance ("AOC") Form
  

Every quarter:

• Conduct a quarterly network scan by an Approved Scan Vendor ("ASV") (if applicable)

Small Merchant Data Security Requirements