— 1.1 1.2 1.3 1.4 1.5 2.1 2.2 2.3 3.1 3.2 3.3 3.4 3.5 3.6 3.7 4.1 4.2 5.1 5.2 5.3 5.4 6.1 6.2 6.3 6.4 6.5 7.1 7. 7.2 7.3 8. 8.1 8.2 8.3 8.4 8.5 8.6 9.1 9.2 9.3 9.4 9.5 10.1 10.2 10.3 10.4 10.5 10.6 10.7 11.1 11.2 11.3 11.4 11.5 11.6 12.1 12.2 12.3 12.4 12.5 12.6 12.7 12.8 12.9 12.10

— R1: Install and maintain a firewall configuration to protect cardholder data R2: Do not use vendor-supplied defaults for system passwords and other security parameters R3: Protect stored cardholder data R4: Encrypt transmission of cardholder data across open, public networks R5: Use and regularly update anti-virus software or programs R6: Develop and maintain secure systems and applications R7: Restrict access to cardholder data by business need to know R8: Assign a unique ID to each person with computer access R9: Restrict physical access to cardholder data R10: Track and monitor all access to network resources and cardholder data R11: Regularly test security systems and processes R12: Maintain a policy that addresses information security for all personnel A1: Secure Payment Card Applications A1.1: Secure Payment Card Applications A1.2: Secure Payment Card Applications A1.3: Secure Payment Card Applications A1.4: Secure Payment Card Applications A2.1: Secure Payment Card Applications A2.2: Be Prepared to Respond to a System Breach A2.3: Be Prepared to Respond to a System Breach A3.1: Implement a PCI DSS Compliance Program A3.2: Document and Validate PCI DSS Scope A3.3: Validate PCI DSS is incorporated into business-as-usual (BAU) activities A3.4: Control and manage logical access to the cardholder data environment A3.4: Identify and respond to suspicious events