Here follow in a shortcut 12 fundamental requirements of PCI DSS (Payment Card Industry Data Security Standard) 

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. It was created by the Payment Card Industry Security Standards Council (PCI SSC) to enhance cardholder data security and reduce credit card fraud

1. Keep a firewall
   1. Block access to CDE (Card Data Environment)
   2. Understanding the network topology and CHD (Card Holder Data) flows
2. No defaults
   1. No vendor passwords
   2. Disabling features, ports,… I don’t need
3. Protect stored data
   1. Truncating, tokenizing, encrypting.. Goal is that even if attacker get them, he can  see them
4. Protect transmitted data
   1. Maintain encryption
   2. Strong authentication
   3. Never PANs as plaintext
5. Prevent malware
   1. Having anti-malware software
   2. Having policies so users can’t disable it
6. Develop securely
   1. Secure SW lifecycle + patching vulnerabilities
7. Need-to-know access
   1. Principle of least privilege: each role sees the least card data, for the least amount of time, to do their job
   2. Having access control by roles
8. Identify access
   1. If something happens, the “associated human” must be identified
   2. Unique IDs, no group users, removing old accounts
   3. Strong password practices, account lockups on X attempts
9. Restrict physical access
   1. Entry control, cctv, locked rooms, etc
10. Log everything
    1. All actions accessing/modifying card data
    2. Time must be synchronized using one mechanism
    3. File integrity management
11. Test regularly
    1. Both internal and external. Audit, penetration testing, vulnerability scanning
12. Information security policy
    1. Sum of all policies: usage, incident response, risk assessment, employee roles/screening
    2. Tech usage policy
    3. Employee screening
    4. Formal incident management procedures, yearly tested