--- title: PCI Compliance Overview description: PCI Compliance Overview --- [![e-Zest logo\_An accion lab company\_Colour](https://blog.e-zest.com/hubfs/images/Logos%20with%20Tagline/Corporate/SVG/e-Zest%20logo_An%20accion%20lab%20company_Colour.svg "e-Zest logo_An accion lab company_Colour")](https://www.e-zest.com/) - [WORK](https://www.e-zest.com/our-work) - [SERVICES](https://www.e-zest.com/our-services) - [Product Engineering](https://www.e-zest.com/digital-product-engineering-services) - [Enterprise Data Services](https://www.e-zest.com/enterprise-data-services) - [Digital Commerce](https://www.e-zest.com/digital-commerce-services) - [Digital Operations](https://www.e-zest.com/digital-operations) - [Digital Consulting](https://www.e-zest.com/digital-transformation-consulting-services) - [Digital Experience Design](https://www.e-zest.com/digital-experience-design) - [INSIGHTS](https://blog.e-zest.com/) - [CAREERS](https://www.e-zest.com/careers) - [ENTERPRISE DATA SERVICES](https://www.e-zest.com/enterprise-data-services) - [GENERATIVE AI](https://www.e-zest.com/generative-ai) - [Healthcare](https://healthcare.e-zest.com) - [Contact Us](https://www.e-zest.com/contact-us) - ![Elevating Product Engineering with AI and ML](https://blog.e-zest.com/hubfs/Elevating%20Product%20Engineering%20with%20AI%20and%20ML.jpg) [BLOGS](https://blog.e-zest.com) #### Elevating Product Engineering with AI and ML As technology evolves and customer choices broaden, there is an increasing ... [Read more](https://blog.e-zest.com/elevating-product-engineering-with-ai-and-ml) - ![e-Zest – An Accion Labs Company gets Recognition as a Contender in the ISG Provider Lens™ Study on Digital Engineering Services 2024](https://blog.e-zest.com/hubfs/e-Zest%20%E2%80%93%20An%20Accion%20Labs%20Company%20-%20Gets%20Recognition%20as%20a%20Contender%20in%20the%20ISG%20Provider%20LensTM%20Study%20on%20Digital%20Engineering%20Services%202024.jpg) [NEWS](https://blog.e-zest.com/news) #### e-Zest – An Accion Labs Company gets Recognition as a Contender in the ISG Provider Lens™ Study on Digital Engineering Services 2024 We are delighted to announce that e-Zest – An Accion Labs Company has been ... [Read more](https://blog.e-zest.com/news/e-zest-an-accion-labs-company-gets-recognition-as-a-contender-in-the-isg-provider-lens-study-on-digital-engineering-services-2024) - ![e-Zest Solutions supports Digital Pune Mission](https://blog.e-zest.com/hubfs/blog-files/Digital%20Literacy%20Bus%20e-Zest.png) [CSR](https://blog.e-zest.com/csr) #### e-Zest Solutions supports Digital Pune Mission **Pune, India:** e-Zest Solutions, a leading digital technology innovation ... [Read more](https://blog.e-zest.com/csr/e-zest-solutions-supports-digital-pune-mission) - [Work](https://www.e-zest.com/our-work) - [Services](https://www.e-zest.com/our-services) - [Insights](https://blog.e-zest.com) - [Careers](https://www.e-zest.com/careers) - [Enterprise Data](https://www.e-zest.com/enterprise-data-services) - [Generative AI](https://www.e-zest.com/generative-ai) - [Innovations](https://www.e-zest.com/innovations) - [Healthcare](https://healthcare.e-zest.com) - [About](https://www.e-zest.com/about-us) - [Contact](https://www.e-zest.com/contact-us) - [Blog](https://blog.e-zest.com/) - [News](https://blog.e-zest.com/news) - [CSR](https://blog.e-zest.com/csr) - [![Linkedin Icon](https://blog.e-zest.com/hubfs/icons/linkedin_icon_white.svg)](https://www.linkedin.com/company/e-zest-solutions/) - [![Twitter Icon](https://blog.e-zest.com/hubfs/twitter-logo-silhouette%20(5).svg)](https://twitter.com/ezest) - [![Facebook Icon](https://blog.e-zest.com/hubfs/facebook-app-logo%20(4).svg)](https://www.facebook.com/61259256638) - [![Instagram Icon](https://blog.e-zest.com/hubfs/instagram-logo%20(4).svg)](https://www.instagram.com/ezestsolutions/) - [![Youtube Icon](https://blog.e-zest.com/hubfs/icons/youtube_icon_white.svg)](https://www.youtube.com/user/ezestcorporate) [![Go to top icon](https://blog.e-zest.com/hubfs/AA%20Assets/top%20button.svg)](https://blog.e-zest.com/pci-compliance-overview/#top) Hit enter to search or ESC to close Insights e-Zest members share technology ideas to foster digital transformation. - [Blog](https://blog.e-zest.com) - [News](https://blog.e-zest.com/news) - [Podcasts](https://www.e-zest.com/podcasts) - [Healthcare](https://blog.e-zest.com/healthcare) - [CSR](https://blog.e-zest.com/csr) - [Whitepaper](https://blog.e-zest.com/whitepaper) - [Playbook](https://blog.e-zest.com/playbook) - [Media Kit](https://www.e-zest.com/media-kit) # PCI Compliance Overview [Lalit Kale](https://blog.e-zest.com/author/lalit-kale) Apr 30, 2012 [PCI Compliance](https://blog.e-zest.com/topic/pci-compliance) [PA-DSS](https://blog.e-zest.com/topic/pa-dss) [PCI DSS](https://blog.e-zest.com/topic/pci-dss) [Control Objectives](https://blog.e-zest.com/topic/control-objectives) [Technology](https://blog.e-zest.com/topic/technology) - - - - PCI DSS version 2.0 must be adopted by all organizations with payment card data by 1 January 2011, and from 1 January 2012 all assessments must be against version 2.0 of the standard. It specifies the 12 requirements for compliance, organized into six logically-related groups, which are called “control objectives”. | **Control Objectives** | **PCI DSS Requirements** | | --- | --- | | Build and Maintain a Secure Network | 1. Install and maintain a firewall configuration to protect cardholder data 2\. Do not use vendor-supplied defaults for system passwords and other security parameters | | Protect Cardholder Data | 3. Protect stored cardholder data 4\. Encrypt transmission of cardholder data across open, public networks | | Maintain a Vulnerability Management Program | 5. Use and regularly update anti-virus software on all systems commonly affected by malware 6\. Develop and maintain secure systems and applications | | Implement Strong Access Control Measures | 7. Restrict access to cardholder data by business need-to-know 8\. Assign a unique ID to each person with computer access 9\. Restrict physical access to cardholder data | | Regularly Monitor and Test Networks | 10. Track and monitor all access to network resources and cardholder data 11\. Regularly test security systems and processes | | Maintain an Information Security Policy | 12. Maintain a policy that addresses information security | **Eligibility for PA-DSS Validation:** Applications won’t be considered for PA-DSS Validation, if the ANY of the following point is “TRUE”: 1. Application is released in beta version. 2. Application handle cardholder data, but the application itself does not facilitate authorization or settlement. 3. Application facilitates authorization or settlement, but has no access to cardholder data or sensitive authentication data. 4. Application require source code customization or significant configuration by the customer (as opposed to being sold and installed “off the shelf”) such that the changes impact one or more PA-DSS requirements. 5. Application a back-office system that stores cardholder data but does not facilitate authorization or settlement of credit card transactions. For example: - Reporting and CRM - Rewards or fraud scoring 6. The application developed in-house and only used by the company that developed the application. 7. The application developed and sold to a single customer for the sole use of that customer. 8. The application function as a shared library (such as a DLL) that must be implemented with another software component in order to function, but that is not bundled (that is, sold, licensed and/or distributed as a single package) with the supporting software components. 9. The application function as a shared library (such as a DLL) that must be implemented with another software component in order to function, but that is not bundled (that is, sold, licensed and/or distributed as a single package) with the supporting software components. 10. The application a single module that is not submitted as part of a suite, and that does not facilitate authorization or settlement on its own. 11. The application offered only as software as a service (SAAS) that is not sold, distributed, or licensed to third parties. 12. The application an operating system, database or platform; even one that may store, process, or transmit cardholder data. 13. The application operates on any consumer electronic handheld device (e.g., smart phone, tablet or PDA) that is not solely dedicated to payment acceptance for transaction processing. For [custom software development](https://blog.e-zest.com/custom-it-development/) projects, “Requirement 6: Develop and maintain secure systems and applications” section is more applicable and needs to be taken care while doing the system design and in coding. - - - ### Similar Blog [![What is PCI DSS compliance and how to become PCI DSS compliant?](https://blog.e-zest.com/hubfs/Everything%20you%20need%20to%20know%20about%20PCI%20DSS%20compliance.jpg) What is PCI DSS compliance and how to become PCI DSS compliant? What is PCI compliance? By Rohidas Bagul Nov 08, 2017](https://blog.e-zest.com/pci-dss-compliance-and-how-to-become-pci-dss-compliant) [Understanding Regulatory Compliance in Amazon Web Services (AWS) cloud The problem of regulatory PCI compliance in public cloud such as AWS applies more to small and medium size companies than ... By Devendra Dhawale Apr 30, 2013](https://blog.e-zest.com/understanding-regulatory-compliance-in-amazon-web-services-aws-cloud/) [PCI Compliance Introduction The Payment Card Industry (PCI) has developed security standards for handling cardholder information in a published standard ... By Lalit Kale Apr 25, 2012](https://blog.e-zest.com/pci-compliance-introduction/) [Introduction to Specification Pattern](https://blog.e-zest.com/introduction-to-specification-pattern/) [Specification pattern has emerged out of “Domain Driven Design” phenomenon. It is first identified and articulated](https://blog.e-zest.com/introduction-to-specification-pattern/)[here](http://martinfowler.com/apsupp/spec.pdf) by Eric ... By Lalit Kale Jun 20, 2012 [Considerations for PA-DSS Compliant Solution Development - Part 2](https://blog.e-zest.com/considerations-for-pa-dss-compliant-solution-development-part-2/) [For earlier 9 points kindly refer to my earlier blog at](https://blog.e-zest.com/considerations-for-pa-dss-compliant-solution-development-part-2/)[Considerations for PA-DSS Compliant Solution Development – Part 1](https://blog.e-zest.com/blog/considerations-for-pa-dss-compliant-solution-development-part-1/) By Lalit Kale May 10, 2012 [![Considerations for PA-DSS Compliant Solution Development - Part 1](https://blog.e-zest.com/hs-fs/file-3443236272-png/blog-files/pci.png) Considerations for PA-DSS Compliant Solution Development - Part 1 Following are the considerations for the development and Implementation of software solutions in a PCI-DSS Compliant Environment. ... By Lalit Kale May 04, 2012](https://blog.e-zest.com/considerations-for-pa-dss-compliant-solution-development-part-1/) [PCI Compliance Introduction The Payment Card Industry (PCI) has developed security standards for handling cardholder information in a published standard ... By Lalit Kale Apr 25, 2012](https://blog.e-zest.com/pci-compliance-introduction/) ## Helping Organizations Thrive in the Digital Age [Contact Us](https://www.e-zest.com/contact-us) - [About](https://www.e-zest.com/about-us) - [Services](https://www.e-zest.com/our-services) - [Work](https://www.e-zest.com/our-work) - [Insights](https://blog.e-zest.com/) - [Healthcare](https://healthcare.e-zest.com/) - [Accion Labs](https://www.accionlabs.com/) - - - - - - Dallas - Detroit - Hannover - Vienna - London - Pune © 2025 e-Zest Solutions - [Privacy Policy](https://www.e-zest.com/privacypolicy) - [Cookie Policy](https://www.e-zest.com/cookie-policy) Contact us Contact us e-Zest is a leading digital innovation partner for enterprises and technology companies that utilizes emerging technologies for creating engaging customers experiences. Being a customer-focused and technology-driven company, it always helps clients in crafting holistic business value for their software development efforts. It offers software development and consulting services for cloud computing, enterprise mobility, big data and analytics, user experience and digital commerce.