March 30, 2020 By Stephanie Schmader
Gopal Indurkhya
2 min read

IBM Cloud PCI DSS Guidance provides the framework for how clients can deploy PCI DSS compliant systems and applications on IBM public cloud.

The Payment Card Industry Data Security Standard (PCI DSS) was developed to encourage and enhance cardholder data security and facilitate the global adoption of consistent security measures. PCI DSS provides a baseline of technical and operational requirements designed to protect account information (including card number, expiration date, and verification data).

The IBM Cloud PCI DSS guide includes a high-level overview of PCI DSS requirements, a responsibility matrix summary, and example architectures to help clients deploy and operate a payment processing system to properly handle credit card data in a secure, compliant environment on IBM Cloud. 

Example architecture end-to-end secure flow for a sample IBM Cloud Kubernetes Service application

This guide is intended for IBM Cloud clients who require their IBM Cloud environment and related applications to be PCI DSS-compliant. Readers should be familiar with the latest PCI DSS requirements, as well as have some background on IBM Cloud Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS) architecture.

IBM Cloud clients must independently analyze their particular environments and use cases in order to verify that their own control environment meets the requirements set forth by the PCI Security Standards Council (SSC) and cannot rely solely on this guide. No information in this guide can, or is intended to, supplant any guidance provided to the client by a Qualified Security Assessor (QSA,) the PCI SSC, or the entity’s acquirer.

Learn more

More from Security

How a US bank modernized its mainframe applications with IBM Consulting and Microsoft Azure

9 min read - As organizations strive to stay ahead of the curve in today's fast-paced digital landscape, mainframe application modernization has emerged as a critical component of any digital transformation strategy. In this blog, we'll discuss the example of a fictional US bank which embarked on a journey to modernize its mainframe applications. This strategic project has helped it to transform into a more modern, flexible and agile business. In looking at the ways in which it approached the problem, you’ll gain insights…

Authentication vs. authorization: What’s the difference?

6 min read - Authentication and authorization are related but distinct processes in an organization’s identity and access management (IAM) system. Authentication verifies a user’s identity. Authorization gives the user the right level of access to system resources.  The authentication process relies on credentials, such as passwords or fingerprint scans, that users present to prove they are who they claim to be.  The authorization process relies on user permissions that outline what each user can do within a particular resource or network. For example,…

Intesa Sanpaolo and IBM secure digital transactions with fully homomorphic encryption

6 min read - This blog was made possible thanks to contributions from Nicola Bertoli, Sandra Grazia Tedesco, Alessio Di Michelangeli, Omri Soceanu, Akram Bitar, Allon Adir, Salvatore Sollami and Liam Chambers. Intesa Sanpaolo is one of the most trusted and profitable European banks. It offers commercial banking, corporate investment banking, asset management and insurance services. It is the leading bank in Italy with approximately 12 million customers served through its digital and traditional channels. The Cybersecurity Lab of Intesa Sanpaolo (ISP) needed to…

IBM Newsletters

Get our newsletters and topic updates that deliver the latest thought leadership and insights on emerging trends.
Subscribe now More newsletters