There are 6 main objectives for developers to consider when examining how they will approach PCI DSS compliance:

1) To build and maintain a secure data network – this is a fairly simple requirement that mandates that an up-to-date firewall is in place to reduce the risks of data intrusion or loss. There is also an expectation that default passwords (or any other security setting) provided by suppliers will be changed throughout the network. 2)To ensure that cardholder data is protected. This means ensuring that data stored within your network is as secure as possible against attack and that data during transmission is encrypted particularly when moving through public networks. 3)To ensure that there is a program in place to manage vulnerabilities. In essence that means that anti-virus measures should be in place and regularly updated. Applications must also be developed with security in mind. There’s a requirement to ensure that security is at the heart of your development strategy to ensure PCI DSS compliance. The PCI DSS standard requires a code analysis to take place at least once a year, or every time there are changes made to the application’s code. (see screen show below) 4)Access controls need to be implemented and be as strong as possible. Card holder data should only be shared within the business when there’s a clear business need for that data. Anyone with access to cardholder data systems should have an individual access code assigned to them so that breaches may be tracked. The physical access to such systems should also be as restricted as possible without impacting on functionality. 5)Testing and monitoring need to take place on a regular basis. The software development team should have a test strategy that delivers scheduled unit-tests, integration tests and system tests to adhere to the terms of PCI DSS compliance. 6)Information Security policies should be well-documented and regularly updated. This is good practice for all policy documentation within a development environment as it focuses your team on best practice application of new theory.