PCI DSS Requirement 9 Compliance

In an article by TechTarget, security management expert Mike Rothman discusses the best way to comply with PCI DSS Requirement 9. Of the use of a camera system to help with monitoring, he says that “having a camera outside of the server room, which records with an unalterable time stamp who enters and exits the room, and then having sufficiently detailed log records pertaining to changes made on the servers and cardholder data access is enough.” MSPs and IT professionals need remote management solutions that go beyond just the basic PCI DSS Requirement 9 standards. N‑able offers remote management software that can help you keep your clients’ cardholder data safe by giving you control over all aspects of network security. Our software includes features like encrypted data transfers, detailed application activity logs, and advanced monitoring agents.

What is PCI DSS Requirement 9?

The Payment Card Industry (PCI) has a set of technical and operational requirements to protect cardholder data. These requirements apply to all entities (such as businesses and tech companies) that store, process, or transmit cardholder data. There are 12 requirements in total, and in this article, we’ll take a look at PCI DSS Requirement 9 and discuss how to maintain compliance with these regulations. PCI DSS Requirement 9 requires that entities restrict physical access to cardholder data. It states, “Any physical access to data or systems that house cardholder data provides the opportunity for persons to access and/or remove devices, data, systems or hardcopies, and should be appropriately restricted.” PCI DSS requirement 9 has ten sections you must follow in order to maintain PCI DSS compliance. In these 10 sections, “onsite personnel” means full-time and part-time employees, temporary employees, contractors, and consultants who are physically present on the entity’s premises. “Visitors” means vendors and guests that enter the facility for a short amount of time. “Media” means all paper and electronic media containing cardholder data. 9.1 Use appropriate facility entry controls to limit and monitor physical access to systems in the cardholder data environment. 9.2 Develop procedures to easily distinguish between onsite personnel and visitors, especially in areas where cardholder data is accessible. GIVE EVERY USER A UNIQUE ID. Every user with access to the Cardholder Data Environment must have a unique ID. This allows a business to trace every action to a specific individual. 9.3 Ensure all visitors are authorized before entering areas where cardholder data is processed or maintained; given a physical token that expires and that identifies visitors as not onsite personnel; and are asked to surrender the physical token before leaving the facility or at the date of expiration. 9.4 Use a visitor log to maintain a physical audit trail of visitor information and activity, including visitor name, their company, and the onsite personnel authorizing physical access. Retain the log for at least three months unless otherwise restricted by law. 9.5 Store media back-ups in a secure location, preferably off site. 9.6 Physically secure all media. 9.7 Maintain strict control over the internal or external distribution of any kind of media. Classify media so the sensitivity of the data can be determined. 9.8 Ensure that management approves any and all media moved from a secured area, especially when media is distributed to individuals. 9.9 Maintain strict control over the storage and accessibility of media. 9.10 Destroy media when it is no longer needed for business or legal reasons.

PCI DSS Cloud Computing Guidelines and Compliance

The Payment Card Industry Data Security Standards (PCI DSS) Cloud Computing Guidelines Information Supplement was published in an effort to extend the responsibility for securing credit card information to cloud computing providers. The supplement clearly defines the security responsibilities of the cloud provider and the cloud customer. The PCI DSS Cloud Computing Guidelines Information Supplement was published in an effort to clarify what is required to protect customers’ credit card information and support PCI DSS compliance in the cloud. It goes without saying that any business that conducts credit card transactions is obliged to comply with PCI DSS. But as businesses more and more contract hosted data centers — often cloud based storage centers — to warehouse their customers’ information, the PCI Security Standards Council needed to explicitly extend compliance to these vendors as well. According to the Payment Card Industry Security Standards Council, the responsibility of securing credit card information is shared by both the cloud service provider and its clients. However, the ultimate responsibility for PCI DSS compliance lies with the cloud customer who stores cardholder data with a third-party service provider. The supplement helps organizations with the following: Cloud overview. It explains different models of cloud services and how compliance implementation may vary within different types. Cloud provider and cloud customer roles and responsibilities. The supplement outlines different roles and responsibilities across different cloud models. It also provides guidance on determining and documenting responsibilities for cloud providers and their customers. PCI DSS considerations. The supplement provides guidance and examples to help determine responsibilities for specific PCI requirements. PCI DSS compliance challenges. The supplement describes some of the challenges with demonstrating and documenting PCI DSS compliance for cloud providers. Cloud computing service providers must meet the requirements of PCI DSS according to agreed upon guidelines between providers and their clients. But if there is a security breach, you can rest assured that the businesses conducting transactions via the cloud will suffer dire consequences, and not just of the legal variety. That’s why it is important to choose cloud vendors whose software is designed to be PCI DSS compliant. Even though N‑able is not required to comply with PCI DSS guidelines, it goes above and beyond, and is actually even more rigid than the guidelines.

PCI is the acronym used for the Payment Card Industry. The PCI Data Security Standard is a set of compliance standards in place for the way companies process, store, and transmit payment card information. These compliance measures pertain to any company or organization that accepts, stores, or transmits data of payment card holders. The standards are managed by the PCI Security Standards Council and are in place to help combat credit card fraud, identity theft, and fraud on consumer transactions.

The Role of Encryption in DSS

The PCI DSS is made up of six components to maintain the safe handling of cardholder data. Encryption is just one of these six objectives. According to the objective, merchants and organizations must: Protect stored cardholder data Encrypt transmission of cardholder data across open, public networks In other words, cardholder information must be encrypted whenever it is stored or transmitted. Encrypting files involves the conversion of information into an unintelligible form that can only be decrypted by the holder of a designated cryptographic key. The details of the PCI DSS encryption protocol include: Transparent Data Encryption (TDE) or full disk encryption (recommended) Keys must be changed at least once a year The use of Extensible Key Management with a third-party encryption provider is recommended The full card number should not be clearly visible anywhere on the database An external program should be used to retrieve the card number if necessary and access to that program should be kept limited Secure Sockets Layer (SSL) encryption should be configured Merchants and organizations that must adhere to PCI DSS regulations must implement an encryption protocol.

What does FINRA stand for?

The Financial Industry Regulatory Authority (FINRA) is an independent, not-for-profit organization authorized by the U.S. Congress to protect investors by ensuring the securities industry operates fairly. FINRA not only provides basic protections to investors but ensures that every securities product on the market is tested, qualified, and licensed. According to FINRA.org, “FINRA’s mission is to safeguard the investing public against fraud and bad practices. We pursue that mission by writing and enforcing rules and regulations for every single brokerage firm and broker in the United States, and by examining broker-dealers for compliance with our own rules, federal securities laws and rules of the Municipal Securities Rule-making Board.” Additionally, FINRA makes certain that: Securities products sold to an investor is appropriate for that investor’s needs Investors receive complete disclosure about the investment product before purchase Every securities product advertisement used is truthful and not misleading Every investor receives the basic protections they deserve FINRA Compliant Security Solutions N‑able develops FINRA compliant IT management and security solutions that help MSPs protect and manage customer networks, servers, devices, and machines. In addition to satisfying a host of regulatory compliance requirements, including FINRA, HIPAA, and PCI DSS, N‑able enables managed service providers to conduct automatic risk assessments to calculate an organization’s risk of a data breach (and how much money it will likely cost).

MSP Security Software Network Security Audit Tools Endpoint Security Software IT Risk Management Software Network Security Scanning Software

https://www.googletagmanager.com/ns.html?id=GTM-M897H7</a>" height="0" width="0" style="display:none;visibility:hidden">

Features

Sensitive authentication data like security codes or pins have specific rules under PCI DSS. Find out what you need to follow.

Scopri di più

Choose the N‑able secure email gateway for MSPs with email spoofing protection at an affordable price.

Scopri di più

Automate network mapping with precision and keep track of your infrastructure in real-time

Scopri di più

With cloud-based spam filtering, MSPs can help ensure maximum email security for their business customers.

Scopri di più

A solution for every MSP

Emerging MSPs

Tecnico, dirigente, addetto commerciale: tu sei tutto questo. Un buon partner ti permette di fare tutto questo.

Growth MSPs

Il tuo obiettivo è scalare le procedure operative con un partner che offra assistenza globale e personalizzata.

Enterprise Service Providers

Conosci gli aspetti fondamentali e ora il tuo obiettivo è lavorare in modo efficiente su vasta scala.

IT Departments

Un reparto IT ben organizzato ha qualcosa di magico. Tutto funziona al meglio e implementi innovazioni ogni giorno.

Cove offre ora supporto per il disaster recovery nel cloud in Azure

Report sulla situazione dei SOC per il 2025

N‑able è campione per Canalys per il secondo anno consecutivo

Features

PCI DSS and SAD Standards

Email Spoofing Protection Software

Network Diagram Software

Spam Filtering

A solution for every MSP

Emerging MSPs

Growth MSPs

Enterprise Service Providers

IT Departments