White paper

The Principles of PCI Compliance..

Take the time to understand and learn to apply the requirements
for locking down payment card data.

Executive Summary
Credit card and debit card information are among the most

Table of Contents

sensitive types of information that organizations must handle.

When such data falls into the wrong hands, payment card
account number misuse can create identity theft nightmares
for individual consumers and financial losses, lawsuits
and penalties for the banks and organizations that accept

2 The Situation
2 PCI Compliance Defined

fraudulently presented information.

3 The Digital Dozen Requirements

To mitigate these risks, the card-processing industry

5 Overcoming Challenges

developed the Payment Card Industry Data Security

Standard (PCI DSS), often referred to simply as the PCI
DSS. The standard consists of a detailed set of security
requirements that describe methods for storing, processing
and transmitting sensitive cardholder information.
Organizations seeking to comply with the PCI DSS for the
first time face a daunting challenge. The full PCI DSS contains
75 pages of detailed requirements, along with multiple
supplementary documents that provide guidance and
requirements for specific technologies and situations.
Fortunately, there are many technology solutions designed
specifically to help organizations comply with the PCI DSS.
These include firewalls, web application security products,
log correlation systems, antivirus packages and more.

TWEET THIS!

6 Taking a Holistic Approach

7 PCI DSS-related Products
8 CDW: A PCI DSS Partner That Gets IT

The Principles of PCI Compliance

The Situation

PCI Compliance Defined

Identity theft is an issue of global concern. Thieves regularly

The PCI standard sets a threshold for compliance that

attempt to acquire the personal information of individuals

represents an acceptable level of information security controls

to create fraudulent financial accounts and steal funds from

surrounding payment card transactions. Organizations that

existing credit and debit cards.

meet the requirements described in the PCI DSS have taken

Many people dont realize that there are multiple victims of

these financial crimes, in addition to the individuals who have

the basic steps necessary to properly secure cardholder data,

the ultimate goal of the standard.

their identities stolen. Organizations that accept fraudulent

It is important to remember that the PCI DSS is mostly a

credit cards and the banks that process the transactions

codification of information security best practices that

suffer significant financial and business losses.

IT professionals have adopted over the years. For this

The five major payment card brands Visa, MasterCard,

American Express, Discover and JCB stand to lose the
most from these crimes. Although they are not directly

reason, it is often easier to approach PCI compliance when

an organization is also adopting a comprehensive approach
to data security in general.

responsible for fraudulent transactions, they depend upon

The controls required by the PCI DSS include firewalls,

the individuals and entities that bear the financial risk

encryption, antivirus software, strong passwords and other

for their continued survival.

security measures that are common-sense best practices.

If credit card fraud were to continue unchecked, both

consumers and organizations would lose faith in the integrity
of the card-processing networks. And they would grow
resistant to the higher costs of card processing required to
compensate for fraudulent activity. Realizing that they share a
common goal of reducing fraud, entities that normally compete
in the marketplace came together to form the Payment Card
Industry Security Standards Council (PCI SSC).

Entities already having strong data security programs will

find that PCI compliance may require only tweaking the
controls in place and adopting documentation, testing and
validation procedures.

Who Must Comply

The PCI DSS applies to two types of organizations: those that
accept payment cards (typically referred to as merchants) and
service providers that facilitate transactions. Merchants must

This organization, funded by the payment card brands and

comply based on the terms of their credit-card-processing

voluntary membership fees, is responsible for creating and

agreements with their banks.

maintaining a consistent set of standards that govern the

world of payment card processing. The PCI DSS contains
strict guidelines governing the ways that organizations
handle payment card information, with the aim of reducing
payment card fraud.
Contrary to common belief, the PCI DSS is not a law or
regulation imposed upon organizations by the government.
Rather, it is a voluntary standard that entities agree to follow
when they sign a payment card merchant agreement.

Service providers must comply because merchants are

permitted to conduct business only with PCI-compliant
service providers. Essentially, any organization involved in the
storage, processing or transmission of credit card information
must comply with the PCI DSS.
The PCI SSC developed the PCI standard with input from the
payment card brands, merchants and service providers. The
council uses a collaborative process to update the standard on
a three-year cycle based on feedback from everyone involved

These agreements are legally binding contracts: Organizations

in payment card processing. The current version of the

commit to compliance with the PCI DSS and agree that they

standard, PCI DSS 2.0, can be found on the PCI SSC website.

will be subject to financial and business penalties if they fail to

live up to their compliance commitments. These commitments
include implementing the security controls described in
the PCI DSS and conducting a series of periodic tests and
assessments to validate compliance to the merchant bank
that processes their payment card transactions.
The bank, in turn, has a responsibility to the credit card brands
to ensure that all organizations using the banks network
adhere to the PCI DSS requirements. Banks and organizations
take this responsibility very seriously, as the penalties for
failure to comply can run to thousands of dollars and might
restrict an organizations future ability to participate in the
payment-processing network.
TWEET THIS!

Although organizations must comply with all aspects of the

PCI DSS, the payment card brands divide organizations into
levels that dictate the types of validation that they must
perform to prove their compliance. For example, Visa divides
merchants into four levels based upon the number and type of
Visa transactions processed annually:

Level 1: Merchants who process more than 6 million

transactions annually

Level 2: Merchants who process between 1 million and

6 million transactions annually

Level 3: Merchants who process between 20,000 and

1 million e-commerce transactions annually

800.800.4239 | CDW.com

Level 4: Merchants who process fewer than 1 million

total transactions and fewer than 20,000 e-commerce

transactions annually

Visa does not set specific validation requirements for Level 4

organizations, leaving that determination up to the merchants
bank. Level 2 and 3 organizations must complete an annual

5 Benefits of Compliance
Many organizations consider compliance with PCI and other
regulations a nuisance imposed upon them by regulators.
But its important to realize that compliance also brings
business benefits.

complete an attestation of compliance form. Level 1 replaces

Here are five specific benefits that organizations typically

realize as a result of their PCI compliance efforts:

the self-assessment with a compliance report by a qualified

1. Decreased risk of a security breach

self-assessment, conduct quarterly network scans and

independent qualified security assessor (QSA).

All of the card brands have similar systems based on annual
transactions. MasterCard and Discover use the same fourlevel system as Visa. American Express has a three-level
system with categories of less than 50,000 transactions,
50,000 to 2.5 million transactions, and more than 2.5 million
transactions. JCB has a two-level system more than or less
than 1 million transactions.

Hardening POS Systems

2. Peace of mind
3. Avoidance of costly fines
4. Easy path to a secure environment
5. Customer confidence boost

The Digital Dozen Requirements

The complete PCI DSS contains 75 pages describing the
specific administrative, technical and physical controls

A common source of credit card security breaches are the

required to secure credit and debit card transactions.

point of sale (POS) systems used to perform credit card

The specifications fall under 12 requirements, known as

transactions. These sophisticated, computerized cash

the Digital Dozen, then grouped into six major

register systems handle all aspects of a customer transaction,

implementation categories:

including accepting payment via credit or debit card.

1. Build and maintain a secure network.

POS systems are often networked with other systems

2. Protect cardholder data.

that process and store data on a centralized server. In the

case of large organizations, the POS system might be linked

3. Maintain a vulnerability management program.

to a large network of servers and data centers. Consequently,

4. Implement strong access control measures.

the risk from exposing data through a security breach

5. Monitor and test networks regularly.

increases exponentially.
There are three specific vulnerabilities that the IT team should

6. Maintain an information security policy.

consider when securing a POS system:

Build and Maintain a Secure Network

Remote access: Allowing employees to remotely manage

The first set of requirements revolves around network

POS terminals can create openings for attackers to gain

access to the system and the sensitive data it handles.

End-user devices: POS terminals are often full-featured

systems. They require the same degree of security

security practices, including the secure configuration of

routers and firewalls and the elimination of default passwords.

Requirement 1: Install and maintain a firewall configuration to

protect cardholder data.

protection as a desktop computer, for example. Failure to

Any organizations using systems to handle cardholder data

apply security patches, update antimalware software and

must protect those systems with a stateful inspection firewall.

configure host firewalls can lead to system compromise.

It must segment the network into appropriate zones and

Network connections: The links that connect POS

terminals to one another and the server must be secured

isolate cardholder systems, both from the Internet and noncardholder zones of the internal network.

to prevent attackers from gaining access or eavesdropping

In addition, mobile devices (including any personal devices

on communication. This is particularly critical if wireless

used by workers) within or to interact with the cardholder data

networks connect the terminals.

environment must have host firewalls installed and properly

The PCI standard contains controls designed to mitigate risks.

For example, properly applying the network security controls
described in the PCI DSS should result in a network resistant
to eavesdropping and intrusion. Similarly, the host security
controls and remote-access provisions can safeguard POS
systems against related risks.

configured.

Requirement 2: Do not use products default passwords or

other pre-set security parameters.

Its necessary to change factory-set passwords, Simple

Network Management Protocol (SNMP) community strings
and wireless encryption keys, before connecting equipment to

The Principles of PCI Compliance

the network. Systems must be configured to provide only
the minimum necessary services and to require strong
security, including the use of encryption for remote
administrative access.

Requirement 6: Develop and maintain secure systems

and applications.

Systems and software used within a cardholder data

environment must receive critical security patches within

Interestingly, the requirements sometimes address items

one month of their release. The IT department must also

that may not seem directly related to the requirement title.

provide a vulnerability monitoring program, establish change

For example, its a bit unexpected for a requirement that

control procedures and use secure coding practices. If the

ostensibly covers changing manufacturer-set defaults to

organization has public-facing web applications, those apps

also include requirements for disabling unused services

must either be protected by a web application firewall or

and requiring encrypted administrative access to servers.

regularly assessed for vulnerabilities.

For this reason, its important that the IT team review all

The requirements in this category may seem innocuous at first

subrequirements in detail when implementing a PCI DSS

compliance program.

Protect Cardholder Data

The second category of requirements involves minimizing use
of cardholder data and applying appropriate security controls
to protect that data, both while it is stored and in transit over
the network.

Requirement 3: Protect stored cardholder data.

Organizations should try to reduce the amount of cardholder
data that they store and never, under any circumstances,
store personal identification numbers, card verification codes
or the full contents of magnetic stripes. Strong encryption
and key management practices must protect stored payment
card numbers.

Requirement 4: Encrypt transmission of cardholder data

across open, public networks.

Organizations must use strong cryptography to secure

payment card information when its sent over the Internet,
wireless networks and via email or other messaging systems.
The minimization principle is an excellent approach to PCI
compliance efforts generally. If the IT team can convince
managers to reduce the amount of cardholder data that
is processed or stored, as well as the number of system
components that touch that information, it will be able to
shrink the overall scope of the compliance efforts, thereby
helping to facilitate a successful PCI strategy.

Maintain a Vulnerability Management

Program

glance but contain some of the most detailed controls required

by the PCI, especially for public-facing web apps.

Implement Strong Access Control Measures

Access controls are one of the cornerstones of information
security, limiting system and information access to individuals
with appropriate authorization. There are three requirements
in this PCI DSS category.

Requirement 7: Restrict access to cardholder data based

on need to know.

Systems and apps must strictly limit access to cardholder

information to individuals with a legitimate need to access the
information. This must be done using an access control system
with a default deny all policy.

Requirement 8: Assign a unique ID to each person with

computer access.

The IT department needs to create unique login IDs and apply

strong authentication measures. Any remote access to the
network must require multifactor authentication.

Requirement 9: Restrict physical access to cardholder data.

Entities must establish facility entry controls and use video
surveillance to monitor cardholder systems. This requirement
also mandates visitor control procedures, inventory processes
and the appropriate destruction of electronic media when it is
no longer needed.
Organizations that run their own data centers may find that
they need to revise their physical security controls after
reviewing the detailed specifications in Requirement 9.
Those that use outsourced services or colocation sites must

All entities must implement security controls to protect

ensure that the third-party providers meet the PCI DSS

against malicious code and other known vulnerabilities. This

physical security requirements. Typically, these third-party

includes measures to ensure staying current on emerging

providers undergo their own PCI compliance attestations as

threats and taking appropriate action to protect against them.

service providers.

Requirement 5: Use and regularly update antivirus software

or programs.

IT shops must implement antivirus software on all desktop

computers, servers and other devices commonly affected
by malicious code. Software must be regularly updated with
current virus definitions.
TWEET THIS!

Monitor and Test Networks Regularly

In addition to implementing the physical, technical and
administrative controls described in the previous four
categories, organizations must develop routine procedures to
ensure that they maintain compliance over time.

800.800.4239 | CDW.com

Requirement 10: Track and monitor all access to network

resources and cardholder data.

The IT team must maintain detailed logs from cardholder

system components for at least one year. But either a staff
member or an automated tool must review the logs each day.
The requirement contains detailed provisions about what must
be included in the audit trail.

Requirement 11: Regularly test security systems

and processes.

The IT department must conduct quarterly wireless scans,

quarterly network vulnerability scans and annual penetration
tests. Technical controls must also include the use of intrusion
detection systems and file-integrity monitoring tools.
This category includes a number of ongoing activities that
must be conducted to maintain compliance. Many IT shops use
a checklist approach to ensure that they perform each activity
at the required time.
One of the other major compliance challenges that
organizations face revolves around log management.
This is a critical step in building a solid information security
environment and staying ahead of potential attackers,
as logs provide important clues that might tip off security
staff to intrusions in progress or provide evidence of a
suspected breach.
Many entities undertaking a PCI compliance program for the
first time find that they dont have a robust event management
system and are not maintaining the records needed to meet
the provisions of Requirement 10. Log management software
can assist with meeting this compliance challenge, offering
both log retention and analysis.
Some entities may find they can sidestep the rigors of this
requirement if they do not store cardholder data: another
strong argument for minimizing the extent to which
cardholder data is retained.

Maintain an Information Security Policy

The final category includes a single requirement.

Requirement 12: Maintain a policy that addresses information

security for all personnel.

Organizations subject to the PCI DSS must maintain written

policies covering a variety of information security activities
and review those policies on an annual basis. A specific
individual or team must be designated to fulfill the various

are involved. Although PCI DSS requirements often appear

IT centric, sometimes the easiest path to success will involve
making a simple change to a workflow involving payment
card transactions.

A Framework for
PCI Compliance Initiatives
Becoming PCI-compliant may have ripple effects
throughout an organization. To make the transition
as stress-free as possible, consider using this fourstep framework:

Step 1: Define the scope. Begin by defining the boundaries

of the cardholder data environment. Taking steps to
narrow these boundaries as tightly as possible will reduce
the effort required to become compliant. Therefore,
spending some time on this step is worthwhile.

Step 2: Evaluate requirement needs. Once the scope of

the compliance effort has been defined, identify the

specific requirements that apply to the organizations
operations. For example, if there are no web applications,
a web application firewall wont be necessary. One of
the best ways to evaluate and define the necessary
requirements is to review the various self-assessment
questionnaires (SAQs) on the PCI SSC website and identify
those that apply.

For obvious reasons, it is important to determine which

SAQ applies to each organization. Guidance about
selecting the proper SAQ is also available on the PCI SSC
website, and the deciding factors generally revolve around
how the organization makes use of payment card data.

Step 3: Identify obstacles and set a plan. Next, perform a

gap analysis using the SAQs. Which security controls are

already in place? Are there controls that require tweaks to
reach compliance? Are major controls missing? Develop a
plan to move from the current state to a compliant one.

Step 4: Execute the plan. Finally, begin the work of bringing

the organization into compliance. Depending upon the
number of transactions processed annually, the entity
may need to submit either an SAQ or a third-party report
on compliance (ROC) to its merchant bank.

Overcoming Challenges
One of the most significant issues that IT departments must
address when working on PCI compliance is a tendency
to overlook details in the standard and not abide by the

security responsibilities, conduct security awareness training

requirements outlined in PCI DSS documents.

and perform pre-employment background checks.

Security professionals need to take time to educate both

Before tackling a compliance initiative, the IT departments

themselves as well as senior management about compliance

members should thoroughly read the standard, which can be

found on the PCI SSC website.
Note: Its also important that representatives from the entity,
who are knowledgeable about how payment cards are used,

obligations. From a management perspective, it can help to

focus on the implications of noncompliance:

Fines: Banks can levy fines on organizations that fail to

comply with the PCI DSS. These may range from small

amounts, such as $25 per month, to significant fines in the

The Principles of PCI Compliance

tens of thousands of dollars. Its important to underst
and that organizations need not suffer a breach to receive
a fine. Failure to comply with the standard is enough to incur
financial penalties.

Breach penalties: If an organization has a breach of

cardholder information, then it may be subject to substantial

sanctions if it is found to be noncompliant with PCI DSS
requirements. Visa, for instance, reserves the right to levy
fines up to $500,000 per breach if an organization is breached
and found to be noncompliant at the time of the breach.
Theres also the potential for the organization to be held
responsible for all direct costs that result from a breach.

Reputational fallout: In the event that news of noncompliance

becomes public, an organization stands to lose face with
its customers or constituents, which may affect their
willingness to make purchases in the future. Theres also the
potential for harming the organizations brand reputation
generally not just with current customers or constituents.
It is important to remember that simply holding credit card
information creates an environment of potential risk. The best
course of action, therefore, is to minimize the amount of such

Data security: testing, identity and access management,

antivirus software and password security requirements

Network security: firewall and network device management,

remote-access provisions and encryption standards

Physical security: access procedures, inventory mechanisms,

visitor controls, video surveillance and data destruction
requirements

Personnel security: user education and training, background

checks and design of proper workflows to protect cardholder

information

IT teams can use this policy framework to build out an

appropriate set of information security controls. The IT team
can choose to implement a centralized security operations
center (SOC) that monitors information security on a 24/7
basis, often with the assistance of specialized security
information management software that provides central
oversight of security technologies and operations.
While IT departments should always strive to minimize the
scope of their PCI-covered activities, the SOC can cover areas
beyond compliance scope that may nevertheless be important

data stored, processed and transmitted, which immediately

to the organization.

reduces both the security exposure and the scope of

A comprehensive testing program is another key element of a

compliance activities required by the PCI DSS.

PCI compliance framework. The overall framework begins with

Taking a Holistic Approach

policies that outline the organizations control objectives and

continues with tactical controls that implement those policies.

Beware of taking a passive attitude when it comes to PCI

The final element necessary for a well-rounded compliance

compliance. In the words of one CIO of a global retailer,

program is an assessment team that conducts testing to

PCI feels like something that is being done to me and not

ensure that all technical, physical and administrative controls

something being done with me.

are correctly deployed and functioning properly. In some

Organizations that have the most successful compliance

instances, such as quarterly external vulnerability scans, IT

programs eschew this attitude. Instead, they adopt an

shops may be required to engage an external party.

active approach to compliance.

In others, such as penetration testing or application security

Instead of designing to the standard, they focus their

review, organizations may find it impractical to maintain the

efforts beyond just protecting credit card information.

necessary skills and tools in-house. In this case, they may

These IT teams craft security programs that encompass

elect to engage a third party for that reason.

all elements of protecting their networks, systems and

Commonly Overlooked Areas

data from abuse or misuse.

The Policy Component

There are two portions of the PCI standard commonly

overlooked or misunderstood by security professionals:

Policies form the core of any well-designed information

virtualization security and log management.

security program. They both designate information security

Many IT departments have deployed virtualization to

responsibilities and provide staff with the appropriate

maximize the use of resources and reduce costs. From a

authority to implement controls. Therefore, organizations

compliance perspective, organizations must ensure that they

seeking to become PCI-compliant may wish to start by

continue to meet the requirements of PCI DSS Section 2.2.1,

creating a set of information security policies that meet the

which mandate that customers implement only one primary

specifications of PCI DSS Requirement 12 and outline the

function per server.

organizations overall approach to information security.

This requires the implementation of security measures that

Policy development should include a review of each of the

strongly separate virtual hosts that are in scope from those

major elements of security:

that are out of scope. Virtualization may also change the ways
that the IT team approaches control implementation. For
example, Trend Micro and Kaspersky Lab have found ways to

TWEET THIS!

800.800.4239 | CDW.com
tie antivirus into the hypervisors, eliminating the need to load

facing websites that meets Requirement 6.6. These firewalls

antivirus on each individual virtual machine.

also protect web apps from direct access to attackers and can

Organizations migrating to a virtualized environment,

or considering doing so, should refer to detailed guidance
on the topic issued by the PCI SSC in PCI DSS Virtualization
Guidelines, released in June 2011 and found on the
council website.

add Secure Sockets Layer (SSL) encryption to apps that do

not natively support it, helping organizations meet PCI DSS
Requirements 3 and 4 as well.

Cisco Systems
The Cisco Compliance Solution for PCI DSS 2.0 implements a

Log management is a routine task that provides a solid

strong approach to the security management of networks

foundation for any information security program. However, it

that contain cardholder data and systems. It follows a three-

is also one of the most overlooked. Security staff often find log

step process for achieving compliance:

management to be tedious work that doesnt always provide

an immediate return on their investment. But well-maintained
logs can be crucial during forensic analysis of a known or
suspected security incident.
The use of logs can rule out the possibility of cardholder
data compromises or confirm an IT teams worst suspicions.
Organizations should carefully review PCI DSS Requirement

1. Define where sensitive payment information flows and

segment those portions of the network.
2. Protect the segmented area with strong perimeter
protection, including network firewalls and intrusion
detection systems.
3. Provide effective monitoring of the segmented network to

10 and configure security incident and event management

watch for threats, misconfiguration and internal espionage.

software to meet its requirements.

WatchGuard Technologies

Another option is to engage a managed service provider to

The XTM unified threat management (UTM) product line

handle the grunt-work of log review. This way only interesting

or important events are escalated to the organizations staff.

can help organizations comply with many PCI DSS technical

requirements. In addition to meeting the core functional
requirements of a firewall, the XTM products provide intrusion

5 Basic Annual Compliance Assessments

1. Regularly assess internal and external networks for
potential vulnerabilities. Use an approved scanning vendor
to conduct quarterly external network scans.

prevention, virtual private network (VPN) and gateway

malware protection to assist organizations in meeting PCI DSS
Requirements 1, 2, 4, 5, 6, 8, 10 and 11.

TIBCO Software

2. Perform penetration tests at least once a year. This must

be conducted by a penetration testing vendor or a qualified
employee, independent from the controls being tested.

TIBCOs LogLogic log management products facilitate the

3. Conduct a code review of all applications prior to

deployment. Any software developed by the organization
for use in the cardholder environment must undergo a formal
code review process.

filtering and forwarding to security operations and compliance

4. Assess or protect web applications from common attacks.

Unless behind a firewall, web apps must be assessed
regularly to ensure they are not vulnerable.
5. Use wireless scanning to protect against rogue devices.
The IT staff must conduct quarterly scans to detect the
presence of rogue wireless access points on the network.
Organizations may wish to build a compliance calendar to
schedule these tests. No IT team wants to find out that it
failed to perform a required test.

PCI DSS-related Products

Many vendors offer security products that can help with
achieving and maintaining PCI DSS compliance.

Barracuda Networks
The companys line of web application firewalls provides
organizations with a PCI DSS compliance solution for public-

scalable collection of logs from a wide variety of platforms.

LogLogic consolidates these logs and performs high-speed
staff. These products can play an essential role in meeting the
provisions of PCI DSS Requirement 10.

Trend Micro
Trend Micro has a variety of security products that can assist
organizations in meeting PCI compliance obligations:

OfficeScan provides malware protection and cloud-based

security controls for physical and virtual systems.

The Endpoint Security Platform offers software distribution,

web protection, data loss prevention and patch management

services for managed systems.

Deep Security offers deep packet inspection, firewall

services, integrity monitoring, log inspection and patch

management for physical, virtual and cloud-based servers.

Vulnerability Management Services automates the

vulnerability scans required by the PCI DSS.

Email Encryption offers identity-based encryption that

protects email messages from eavesdropping without
requiring preregistration.

The Principles of PCI Compliance

800.800.4239 | CDW.com

CDW: A PCI DSS Partner

That Gets IT

log management and virtualization security. We are also an

The PCI DSS represents a collection of good security practices.

your penetration testing and risk assessment needs as well.

If your organization embraces those requirements for its

Our data centers offer a range of managed services that

cardholder data environment, it encourages those practices to

can help you tackle tasks such as log and event management

bleed over into other areas as well.

or intrusion detection system/intrusion prevention system

As a leading provider of technology solutions for business,

(IDS/IPS) monitoring. The CDW approach to customer

approved scanning vendor, and can perform your quarterly

external vulnerability scans. That same team can address

government, education and healthcare, we get it. Weve helped

many organizations navigate the complexities of the PCI DSS
and keep payment card information secure.
Your CDW account manager and solution architects are ready
to assist with every phase of choosing and leveraging the right
security solutions for your PCI compliance needs.
CDW can help with your initial gap analysis, solution design,
product acquisition, new technology deployment, encryption,

service includes:

Gap analysis
Approved scanning vendor (ASV) services
Wireless security testing
Internal and external assessment and penetration testing
Code review
Secure development training

To learn more about CDWs POS solutions and PCI DSS compliance, contact your
CDW account manager, call 800.800.4239 or visit CDW.com/pcicompliance

Safeguard critical data and help

Symantecs solutions enable you to

Trend Micro Deep Security

ensure regulatory compliance with

standardize security, compliance

provides a comprehensive server

McAfee Data Protection solutions.

and management across platforms

security platform designed to

Available individually or bundled in

and endpoints, helping to ensure

simplify security operations while

suites, McAfee Endpoint Encryption

that information, infrastructure

accelerating the ROI of virtualization

and McAfee Data Loss Prevention

and processes can be protected,

and cloud projects. Tightly

solutions provide multilayered

managed and controlled easily

integrated modules easily expand

protection for your data regardless

and automatically. Let CDW and

the platform to ensure server,

of where it resides on the

Symantec ensure that all your data

application and data security across

network, in storage systems or at

is protected and fully recoverable in

physical, virtual and cloud servers,

the endpoint.

the face of any threats.

as well as virtual desktops.

CDW.com/mcafee

CDW.com/symantec

CDW.com/trendmicro

TWEET THIS!
The information is provided for informational purposes. It is believed to be accurate but could contain errors. CDW does not intend
to make any warranties, express or implied, about the products, services, or information that is discussed. CDW , CDWG and
The Right Technology. Right Away are registered trademarks of CDW LLC. PEOPLE WHO GET IT is a trademark of CDW LLC.
All other trademarks and registered trademarks are the sole property of their respective owners.
Together we strive for perfection. ISO 9001:2000 certified
121705 130506 2013 CDW LLC