PCI DSS: требования и сертификация

PCI DSS (Payment Card Industry Data Security Standard) — обязательный стандарт для любой компании, работающей с card data.

12 базовых требований

1) Firewall configuration. 2) Не использовать vendor defaults. 3) Protect stored cardholder data. 4) Encrypt transmission. 5) Anti-malware. 6) Secure systems and software. 7) Restrict access by need-to-know. 8) Unique ID для каждого user. 9) Physical access restriction. 10) Track/monitor access. 11) Regular security testing. 12) Information security policy.

Уровни compliance

Level 1: >6M транзакций/год, annual on-site audit QSA. Level 2: 1–6M, self-assessment SAQ. Level 3: 20K–1M e-commerce. Level 4: <20K. Большинство лицензированных операторов — Level 1 или 2 с обязательным QSA.

Scope reduction

Не хранить card data — использовать tokenization через payment gateway. Not-hosted redirect: gateway hosts payment form. Network segmentation: isolate PCI environment. Result: significantly reduced audit scope и cost.

Стоимость

Level 1 audit: $50K–$200K + remediation. Level 2 SAQ: $15K–$50K. Annual: pentest, ASV scans (quarterly), vulnerability management. Total ownership: $100K–$500K/год для operator. Обязательно для acceptance card payments.