--- title: Considerations for PA-DSS Compliant Solution Development - Part 1 description: Considerations for PA-DSS Compliant Solution Development - Part 1 image: https://blog.e-zest.com/hs-fs/file-3443236272-png/blog-files/pci.png --- [![e-Zest logo\_An accion lab company\_Colour](https://blog.e-zest.com/hubfs/images/Logos%20with%20Tagline/Corporate/SVG/e-Zest%20logo_An%20accion%20lab%20company_Colour.svg "e-Zest logo_An accion lab company_Colour")](https://www.e-zest.com/) - [WORK](https://www.e-zest.com/our-work) - [SERVICES](https://www.e-zest.com/our-services) - [Product Engineering](https://www.e-zest.com/digital-product-engineering-services) - [Enterprise Data Services](https://www.e-zest.com/enterprise-data-services) - [Digital Commerce](https://www.e-zest.com/digital-commerce-services) - [Digital Operations](https://www.e-zest.com/digital-operations) - [Digital Consulting](https://www.e-zest.com/digital-transformation-consulting-services) - [Digital Experience Design](https://www.e-zest.com/digital-experience-design) - [INSIGHTS](https://blog.e-zest.com/) - [CAREERS](https://www.e-zest.com/careers) - [ENTERPRISE DATA SERVICES](https://www.e-zest.com/enterprise-data-services) - [GENERATIVE AI](https://www.e-zest.com/generative-ai) - [Healthcare](https://healthcare.e-zest.com) - [Contact Us](https://www.e-zest.com/contact-us) - ![Elevating Product Engineering with AI and ML](https://blog.e-zest.com/hubfs/Elevating%20Product%20Engineering%20with%20AI%20and%20ML.jpg) [BLOGS](https://blog.e-zest.com) #### Elevating Product Engineering with AI and ML As technology evolves and customer choices broaden, there is an increasing ... [Read more](https://blog.e-zest.com/elevating-product-engineering-with-ai-and-ml) - ![e-Zest – An Accion Labs Company gets Recognition as a Contender in the ISG Provider Lens™ Study on Digital Engineering Services 2024](https://blog.e-zest.com/hubfs/e-Zest%20%E2%80%93%20An%20Accion%20Labs%20Company%20-%20Gets%20Recognition%20as%20a%20Contender%20in%20the%20ISG%20Provider%20LensTM%20Study%20on%20Digital%20Engineering%20Services%202024.jpg) [NEWS](https://blog.e-zest.com/news) #### e-Zest – An Accion Labs Company gets Recognition as a Contender in the ISG Provider Lens™ Study on Digital Engineering Services 2024 We are delighted to announce that e-Zest – An Accion Labs Company has been ... [Read more](https://blog.e-zest.com/news/e-zest-an-accion-labs-company-gets-recognition-as-a-contender-in-the-isg-provider-lens-study-on-digital-engineering-services-2024) - ![e-Zest Solutions supports Digital Pune Mission](https://blog.e-zest.com/hubfs/blog-files/Digital%20Literacy%20Bus%20e-Zest.png) [CSR](https://blog.e-zest.com/csr) #### e-Zest Solutions supports Digital Pune Mission **Pune, India:** e-Zest Solutions, a leading digital technology innovation ... [Read more](https://blog.e-zest.com/csr/e-zest-solutions-supports-digital-pune-mission) - [Work](https://www.e-zest.com/our-work) - [Services](https://www.e-zest.com/our-services) - [Insights](https://blog.e-zest.com) - [Careers](https://www.e-zest.com/careers) - [Enterprise Data](https://www.e-zest.com/enterprise-data-services) - [Generative AI](https://www.e-zest.com/generative-ai) - [Innovations](https://www.e-zest.com/innovations) - [Healthcare](https://healthcare.e-zest.com) - [About](https://www.e-zest.com/about-us) - [Contact](https://www.e-zest.com/contact-us) - [Blog](https://blog.e-zest.com/) - [News](https://blog.e-zest.com/news) - [CSR](https://blog.e-zest.com/csr) - [![Linkedin Icon](https://blog.e-zest.com/hubfs/icons/linkedin_icon_white.svg)](https://www.linkedin.com/company/e-zest-solutions/) - [![Twitter Icon](https://blog.e-zest.com/hubfs/twitter-logo-silhouette%20(5).svg)](https://twitter.com/ezest) - [![Facebook Icon](https://blog.e-zest.com/hubfs/facebook-app-logo%20(4).svg)](https://www.facebook.com/61259256638) - [![Instagram Icon](https://blog.e-zest.com/hubfs/instagram-logo%20(4).svg)](https://www.instagram.com/ezestsolutions/) - [![Youtube Icon](https://blog.e-zest.com/hubfs/icons/youtube_icon_white.svg)](https://www.youtube.com/user/ezestcorporate) [![Go to top icon](https://blog.e-zest.com/hubfs/AA%20Assets/top%20button.svg)](https://blog.e-zest.com/considerations-for-pa-dss-compliant-solution-development-part-1/#top) Hit enter to search or ESC to close Insights e-Zest members share technology ideas to foster digital transformation. - [Blog](https://blog.e-zest.com) - [News](https://blog.e-zest.com/news) - [Podcasts](https://www.e-zest.com/podcasts) - [Healthcare](https://blog.e-zest.com/healthcare) - [CSR](https://blog.e-zest.com/csr) - [Whitepaper](https://blog.e-zest.com/whitepaper) - [Playbook](https://blog.e-zest.com/playbook) - [Media Kit](https://www.e-zest.com/media-kit) # Considerations for PA-DSS Compliant Solution Development - Part 1 [Lalit Kale](https://blog.e-zest.com/author/lalit-kale) May 04, 2012 [PCI DSS](https://blog.e-zest.com/topic/pci-dss) [Solution Development](https://blog.e-zest.com/topic/solution-development) [PA-DSS Compliant](https://blog.e-zest.com/topic/pa-dss-compliant) [Technology](https://blog.e-zest.com/topic/technology) - - - - Following are the considerations for the development and Implementation of software solutions in a PCI-DSS Compliant Environment. These should be treated as functional and/or quality requirements while developing PCI DSS Compliant solution. 1. Ensure that all system components and software are protected from known vulnerabilities by having the latest vendor supplied security patches installed. Install critical security patches within one month of release. This applies to all frameworks as well as operating systems and other software installed in production environment. 2. The PCI-DSS requires that access to all systems in the payment processing environment be protected through use of unique users and complex passwords. Unique user accounts indicate that every account used is associated with an individual user with no use of generic group accounts used by more than one user. Additionally any default accounts provided with operating systems, databases and/or devices should be removed/disabled/renamed as soon as possible. E.g. Default administrator accounts include “administrator” (Windows systems), “sa” (SQL/MSDE), and “root” (UNIX/Linux) should be disabled or removed. The PCI-DSS standard requires the following password complexity for compliance (often referred to as using “strong passwords”): a. Passwords must be at least 7 characters b. Passwords must include both numeric and alphabetic characters c. Passwords must be changed at least every 90 days d. New passwords can’t be the same as the last 4 passwords The PCI-DSS user account requirements beyond uniqueness and password complexity are as follows: a. If an incorrect password is provided 6 times the account should be locked out b. Account lock out duration should be at least 30 min. (or until an administrator resets it) c. Sessions idle for more than 15 minutes should require re-entry of username and password to reactivate the session. d. Do not use group, shared or generic user accounts 3. PCI DSS applies wherever account data is stored, processed or transmitted. The primary account number is the defining factor in the applicability of PCI DSS requirements. PCI DSS requirements are applicable if a primary account number (PAN) is stored, processed, or transmitted. If PAN is not stored, processed or transmitted, PCI DSS requirements do not apply. The following table illustrates commonly used elements of cardholder and sensitive authentication data, whether storage of each data element is permitted or prohibited, and whether each data element must be protected. This table is not exhaustive, but is presented to illustrate the different types of requirements that apply to each data element. ![](https://blog.e-zest.com/hs-fs/file-3443236272-png/blog-files/pci.png?width=936&height=297&name=pci.png) 4. Removal of custom application accounts, user IDs, and passwords before applications become active or are released to customers. 5. Review of custom code prior to release to production or customers in order to identify any potential coding vulnerability. 6. There should be separate development/test and production environments. 7. Reduce the number of personnel with access to the production environment and cardholder data minimizes risk and helps ensure that access is limited to those individuals with a business need to know. 8. Production data (live PANs) are not used for testing or development. 9. Test data and accounts should be removed from production code before the application becomes active. - - - ### Similar Blog [![Is your e-Commerce compliant with PCI DSS revisions?](https://blog.e-zest.com/hubfs/Is%20your%20e-Commerce%20compliant%20with%20PCI%20DSS%20revisions.png) Is your e-Commerce compliant with PCI DSS revisions? e-Commerce has always been a target for swift cyber theft. You may not even realize that your technology has been compromised by ... By Mariam Abuhaideri Jun 14, 2018](https://blog.e-zest.com/is-your-e-commerce-compliant-with-pci-dss-revisions) [![What is PCI DSS compliance and how to become PCI DSS compliant?](https://blog.e-zest.com/hubfs/Everything%20you%20need%20to%20know%20about%20PCI%20DSS%20compliance.jpg) What is PCI DSS compliance and how to become PCI DSS compliant? What is PCI compliance? By Rohidas Bagul Nov 08, 2017](https://blog.e-zest.com/pci-dss-compliance-and-how-to-become-pci-dss-compliant) [![Understanding Regulatory Compliance: PCI DSS Cloud Computing Guidelines](https://blog.e-zest.com/hs-fs/file-3586007425-jpg/blog-files/pci-dss.jpg) Understanding Regulatory Compliance: PCI DSS Cloud Computing Guidelines PCI DSS compliant means complete ownership of the responsibility of the cardholder data (CHD). The client must still ensure they ... By Devendra Dhawale May 07, 2013](https://blog.e-zest.com/understanding-regulatory-compliance-pci-dss-cloud-computing-guidelines/) [Understanding Regulatory Compliance in Amazon Web Services (AWS) cloud The problem of regulatory PCI compliance in public cloud such as AWS applies more to small and medium size companies than ... By Devendra Dhawale Apr 30, 2013](https://blog.e-zest.com/understanding-regulatory-compliance-in-amazon-web-services-aws-cloud/) [Introduction to Specification Pattern](https://blog.e-zest.com/introduction-to-specification-pattern/) [Specification pattern has emerged out of “Domain Driven Design” phenomenon. It is first identified and articulated](https://blog.e-zest.com/introduction-to-specification-pattern/)[here](http://martinfowler.com/apsupp/spec.pdf) by Eric ... By Lalit Kale Jun 20, 2012 [Considerations for PA-DSS Compliant Solution Development - Part 2](https://blog.e-zest.com/considerations-for-pa-dss-compliant-solution-development-part-2/) [For earlier 9 points kindly refer to my earlier blog at](https://blog.e-zest.com/considerations-for-pa-dss-compliant-solution-development-part-2/)[Considerations for PA-DSS Compliant Solution Development – Part 1](https://blog.e-zest.com/blog/considerations-for-pa-dss-compliant-solution-development-part-1/) By Lalit Kale May 10, 2012 [PCI Compliance Overview PCI DSS version 2.0 must be adopted by all organizations with payment card data by 1 January 2011, and from 1 January 2012 all ... By Lalit Kale Apr 30, 2012](https://blog.e-zest.com/pci-compliance-overview/) [PCI Compliance Introduction The Payment Card Industry (PCI) has developed security standards for handling cardholder information in a published standard ... By Lalit Kale Apr 25, 2012](https://blog.e-zest.com/pci-compliance-introduction/) ## Helping Organizations Thrive in the Digital Age [Contact Us](https://www.e-zest.com/contact-us) - [About](https://www.e-zest.com/about-us) - [Services](https://www.e-zest.com/our-services) - [Work](https://www.e-zest.com/our-work) - [Insights](https://blog.e-zest.com/) - [Healthcare](https://healthcare.e-zest.com/) - [Accion Labs](https://www.accionlabs.com/) - - - - - - Dallas - Detroit - Hannover - Vienna - London - Pune © 2025 e-Zest Solutions - [Privacy Policy](https://www.e-zest.com/privacypolicy) - [Cookie Policy](https://www.e-zest.com/cookie-policy) Contact us Contact us e-Zest is a leading digital innovation partner for enterprises and technology companies that utilizes emerging technologies for creating engaging customers experiences. Being a customer-focused and technology-driven company, it always helps clients in crafting holistic business value for their software development efforts. It offers software development and consulting services for cloud computing, enterprise mobility, big data and analytics, user experience and digital commerce.