PCI DSS

Match the solution to the PCI requirement

Trend Micro offers proven solutions that address most PCI DSS requirements and enable you to truly safeguard your business infrastructure against the compromise of cardholder data. The following table summarizes the products that address each requirement.

PCI Requirement	Direct Mapping	Compensating Control
1.1—Establish firewall and router configuration standards.	Deep Security
1.2—Firewall connections between untrusted networks and any system containing cardholder data.	Deep Security	OfficeScan Worry-Free Business Security Email and Collaboration Security
1.3—Prohibit direct public access between the Internet and any system component in the cardholder data environment.	Deep Security
1.4—Install personal firewall software on any mobile and/or employee-owned computers with direct connectivity to the Internet.	OfficeScan Worry-Free Business Security Deep Security
2.2—Develop configuration standards for all system components. Assure that these standards address all known security vulnerabilities and are consistent with industry-accepted system hardening standards.	Deep Security	Smart Protection Network Trend Micro Messaging Security Solutions
2.4, A.1—Hosting providers must protect each entity’s environment.	Worry-Free Business Security Hosted Email Security Email Encryption	Deep Security
3.1—Keep cardholder data storage to a minimum. Develop a data retention and disposal policy. Limit storage amount and retention time to that which is required for business, legal, and/or regulatory purposes, as documented in the data retention policy.	Email Encryption	Data Loss Prevention
3.2—Don’t store authentication info.	Email Encryption	Data Loss Prevention
3.4—Render PAN, at minimum, unreadable anywhere it is stored (including data on portable digital media,…)		Data Loss Prevention Email Encryption Client
3.5—Protect cryptographic keys used for encryption of cardholder data against both disclosure and misuse…	Email Encryption
3.6—Fully document and implement all key-management processes and procedures for cryptographic keys used for the encryption of cardholder data…	Email Encryption
4.1—Use strong cryptography and security protocols such SSL/TLS or IPSEC to safeguard sensitive cardholder data during transmission over open, public networks.	Email Encryption
4.2—Never send unencrypted PANs by end-user messaging technologies (for example, e-mail, instant messaging, chat).	Data Loss Prevention Email Encryption IM Security for Microsoft Office Communications Server ScanMail Suite for Microsoft Exchange
5.1—Deploy antivirus software on all systems commonly affected by malicious software (particularly personal computers and servers).	OfficeScan Worry-Free Business Security InterScan Messaging Security PortalProtect for Microsoft SharePoint ScanMail Suite for Microsoft Exchange IM Security for Microsoft Office Communications Server	Smart Protection Network Web Protection Module Deep Security InterScan Web Security Threat Management Services
5.2—Ensure that all antivirus mechanisms are current, actively running, and capable of generating audit logs.	OfficeScan Worry-Free Business Security PortalProtect for Microsoft SharePoint ScanMail Suite for Microsoft Exchange IM Security for Microsoft Office Communications Server	Smart Protection Network InterScan Web Security Threat Management Services
6.1—Ensure that all system components and software have the latest vendor-supplied security patches installed.	Patch Management	Smart Protection Network
6.2—Establish a process to identify newly discovered security vulnerabilities.		Smart Protection Network Threat Management Services
6.3—Develop software applications in accordance with PCI DSS…		Deep Security Threat Management Services
6.5—Develop internal and external web applications based on secure coding guidelines.		Deep Security Threat Management Services
6.6—For public-facing web applications, address new threats and vulnerabilities on an ongoing basis and ensure these applications are protected against known attacks by either of the following methods: - Reviewing public-facing web applications via manual or automated application vulnerability security assessment tools or methods, at least annually and after any changes. - Installing a web-application firewall in front of public-facing web applications.	Deep Security Threat Management Services	Smart Protection Network
9.7—Control distribution of media containing cardholder data.		Data Loss Prevention
9.9—Control storage and accessibility of media containing cardholder data.		Data Loss Prevention
10—Track and monitor all access to network resources and cardholder data.
10.5—Secure audit trails so they cannot be altered.	Deep Security
11.2—Run internal and external network vulnerability scans at least quarterly and after any significant change in the network … - Note: Quarterly external vulnerability scans must be performed by an Approved Scanning Vendor (ASV)		Deep Security Threat Management Services
11.3—Perform external and internal penetration testing at least once a year and after any significant infrastructure or application upgrade or modification.		Threat Management Services
11.4—Use intrusion detection systems	Deep Security
11.5—Deploy file-integrity monitoring software to alert personnel to unauthorized modification of critical system files, configuration files, or content files;	Deep Security
12.6—Implement a formal security awareness program	Trend Micro Messaging Security Solutions	OfficeScan Worry-Free Business Security Data Loss Prevention Deep Security

PCI DSS

Match the solution to the PCI requirement

PCI Requirement

Direct Mapping

Compensating Control

Purchase

If you lack virtual server security, you are NOT compliant

Endpoint Security Solutions

Messaging Security Solutions

Web Security Solutions