Cardholder Information Security Program. If you accept EC transactions, you must: install and maintain a working network firewall to protect data accessible via the Internet, keep security patches up-to-date, encrypt stored data and data sent over open networks, use and update anti- virus software, restrict access to data by business “need-to-know”, assign a unique ID to each person with computer access to data, not use vendor- supplied defaults for system passwords and other security parameters, track access to data by unique ID, regularly test security systems and processes, maintain a policy that addressed information security for employees and contractors, and restrict physical access to Cardholder information.
