name: pci-basic
description: PCI DSS Basic Compliance Guidelines
category: security
rules:
  - "Never store full card numbers (PAN) in plaintext — use tokenization or truncation (first 6/last 4 only)"
  - "Never log, print, or include in error messages: full PAN, CVV/CVC, PIN, or magnetic stripe data"
  - "Encrypt cardholder data at rest using AES-256 or equivalent — manage keys separately from encrypted data"
  - "Transmit cardholder data only over TLS 1.2+ — reject connections using older protocols"
  - "Isolate payment processing systems from the general application network — use dedicated subnets or services"
  - "Restrict access to cardholder data to only the services and personnel that absolutely need it"
  - "Use unique credentials for every user and service account that accesses payment systems — no shared accounts"
  - "Enforce multi-factor authentication for all administrative access to payment processing environments"
  - "Log all access to cardholder data and payment systems — include who, what, when, and from where"
  - "Retain audit logs for at least one year, with a minimum of three months immediately available for analysis"
  - "Run vulnerability scans on all payment-facing systems quarterly and after any significant change"
  - "Never use vendor-supplied default passwords or settings on any system in the cardholder data environment"
  - "Mask PAN when displayed — show no more than first 6 and last 4 digits unless there is a legitimate business need"
  - "Implement a web application firewall (WAF) or rigorous code review for all public-facing payment applications"
  - "Maintain an inventory of all system components in scope for PCI DSS and review scope annually"