SECURING FIBRE CHANNEL FABRICS - Brocade

Payment Card Industry Data Security Standard (PCI-DSS)Maintain an information security policy:• Maintain a policy that addresses information securitySensitive cardholder data under the PCI-DSS is defined as:• Primary Account Number (PAN)• Cardholder name• Service code• Expiration datePCI-DSS uses a multi-tiered approach to managing merchant risks thatdepends on several factors. Merchants fall into a specified merchantlevel based on the criteria identified in Table 12.Table 1. PCI-DSS merchant levels and criteriaMerchant LevelLevel 1Level 2Level 3Level 4Criteria• All merchants processing over 6 million transactionsper year• Merchants whose data has been previouslycompromised• Any merchant deemed to meet Level 1 compliance• All merchants processing from 1 to 6 million transactionsper year• All merchants required by another payment networkto report compliance as a Level 2 merchant• All merchants processing from 20,000 to 1 milliontransactions per year• All merchants required by another payment networkto report compliance as a Level 3 merchant• All other merchantsLevel 1 merchants, due to the significant number of transactions theyprocess, are required to have an annual onsite audit. All other merchantsmust complete an annual self-assessment questionnaire andall merchants, including Level 1, must undergo a quarterly networksecurity scan performed by an approved scanning vendor (ASV).Securing Fibre Channel Fabrics 157