Tagged Questions
1
vote
1answer
69 views
Requirement 12.1.2 of PCI DSS: Is it enough to point to a standard process?
Item 12.1.2 of PCI DSS requires that the company's security policy:
12.1.2 Includes an annual process that identifies threats, and vulnerabilities, and results in a formal risk assessment.
NIST ...
10
votes
4answers
316 views
PCI-DSS - one application per server?
How do I interpret the 2.2.1 point for PCI-DSS? Is "application server" 'one primary function' or does it need to be "program x server", "program y server" etc?
I have a collection of applications ...
5
votes
3answers
237 views
Certifiable standards for server security, besides PCI-DSS?
The Payment Card Industry Data Security Standard is widely used in the financial industry and seems to be a useful requirement from the standpoint of a potential customer (see also Does PCI compliance ...
17
votes
5answers
733 views
Does PCI compliance really reduce risk and improve security?
Might as well bring this hot topic to here!
For those not in the know: https://www.pcisecuritystandards.org/
