PCI DSS Compliance Checklist for Tribal Organizations

Isolate systems that store, process, or transmit cardholder data from the rest of the network using segmentation.

Deploy firewalls and network security controls to protect the cardholder data environment from untrusted networks.

Change vendor-supplied defaults and remove unnecessary services, protocols, and accounts from system components.

Define data retention and disposal policies limiting storage of cardholder data to the minimum amount and duration necessary.

Protect stored cardholder data with encryption, truncation, masking, or hashing. Never store sensitive authentication data after authorization.

Encrypt cardholder data with strong cryptography during transmission over open or public networks.

Install and regularly update anti-malware software on all systems commonly affected by malicious software.

Establish a process for identifying and addressing security vulnerabilities including timely patching.

Perform quarterly internal and external vulnerability scans and penetration tests at least annually.

Restrict physical access to cardholder data and systems with appropriate facility entry controls and monitoring.

Limit access to cardholder data to only those individuals whose job requires such access based on need-to-know.

Ensure every person with computer access is assigned a unique identification for tracking and accountability.

Review logs and security events daily to identify anomalies or suspicious activity in the cardholder data environment.

Implement logging mechanisms to track all access to network resources and cardholder data for anomaly detection.

Regularly test security systems and processes including wireless analyzer scans, file integrity monitoring, and IDS/IPS.

Train all personnel upon hire and annually on cardholder data security policies and procedures.

Establish, publish, maintain, and disseminate a comprehensive information security policy for all personnel.

Create and regularly test an incident response plan for immediately responding to a system breach.