---
title: "PCI DSS Requirement 2: Securely Configure System Components"
description: PCI DSS Requirement 2 details how to apply secure configurations to system components to reduce the means available to an attacker to compromise systems.
image: https://blog.basistheory.com/hubfs/pci-dss-requirement-2.png
---

[Skip to content](https://blog.basistheory.com/pci-dss-requirement-2#main-content)

![Basis Theory logo](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=365&height=122&name=BTLogo%20(1).png)

- [Use Cases](https://basistheory.com/)
  
  Show submenu for Use Cases 
  
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions)
    - [Travel](https://basistheory.com/use-cases/travel)
    - [VSaaS](https://basistheory.com/use-cases/vsaas)
- Solutions
  
  Show submenu for Solutions 
  
    - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce)
    - [Data Consolidation](https://basistheory.com/solution/data-consolidation)
    - [Monetize Payments](https://basistheory.com/solution/monetize-payments)
    - [Multi PSP](https://basistheory.com/solution/multi-psp)
    - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery)
    - [Payment Vault](https://basistheory.com/solution/payment-vault)
- [Platform](https://basistheory.com/platform)
  
  Show submenu for Platform 
  
    - [Enrichments & Add-Ons](https://basistheory.com/add-ons)
    - [Partners](https://basistheory.com/partnerships)
    - [Why Basis Theory](https://basistheory.com/why-basis-theory)
- [Pricing](https://basistheory.com/pricing)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://blog.basistheory.com)
    - [Case Studies](https://blog.basistheory.com/case-studies)
- [Docs](https://developers.basistheory.com/)

Open main navigation

Close main navigation

- [Use Cases](https://basistheory.com/)
  
  Show submenu for Use Cases 
  
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Subscription Merchants](https://basistheory.com/use-cases/subscriptions)
    - [Travel](https://basistheory.com/use-cases/travel)
    - [VSaaS](https://basistheory.com/use-cases/vsaas)
- Solutions
  
  Show submenu for Solutions 
  
    - [Agentic Commerce](https://basistheory.com/solution/agentic-commerce)
    - [Data Consolidation](https://basistheory.com/solution/data-consolidation)
    - [Monetize Payments](https://basistheory.com/solution/monetize-payments)
    - [Multi PSP](https://basistheory.com/solution/multi-psp)
    - [Payment Method Discovery](https://basistheory.com/solution/payment-method-discovery)
    - [Payment Vault](https://basistheory.com/solution/payment-vault)
- [Platform](https://basistheory.com/platform)
  
  Show submenu for Platform 
  
    - [Enrichments & Add-Ons](https://basistheory.com/add-ons)
    - [Partners](https://basistheory.com/partnerships)
    - [Why Basis Theory](https://basistheory.com/why-basis-theory)
- [Pricing](https://basistheory.com/pricing)
- Resources
  
  Show submenu for Resources 
  
    - [Blog](https://blog.basistheory.com)
    - [Case Studies](https://blog.basistheory.com/case-studies)
- [Docs](https://developers.basistheory.com/)
- [Get a demo](https://basistheory.com/contact)

[Login](https://portal.basistheory.com/)

[Get a demo](https://basistheory.com/contact)

 August 17, 2023

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) ·

[PCI Compliance](https://blog.basistheory.com/tag/pci-compliance)

# PCI DSS Requirement 2: Securely Configure All System Components

![PCI DSS Requirement 2: Securely Configure Components](https://blog.basistheory.com/hubfs/pci-dss-requirement-2.png)

Attackers often use default passwords and other vendor default settings to compromise systems. These passwords and settings are both well known and easily accessible publicly for anyone to find. That is why it is imperative for merchants to update and secure system credentials.

Applying secure configurations to system components reduces the means available to an attacker to compromise the system. Changing default passwords; removing unnecessary software, functions, and accounts; and disabling or removing unnecessary services all help reduce the potential of an attack.

PCI DSS Requirement 2 outlines the specifics of how to keep systems secure and how to reduce the risk of an attacker gaining access to sensitive information. For additional details and specifics of Requirement 2, read on.

For additional details on all 12 of the Requirements, read our [PCI DSS Requirements overview](https://blog.basistheory.com/12-pci-dss-requirements).

## Requirement 2 Details and Sections

PCI DSS Requirement 2 has three total sections that detail specifics on securely configuring your system components.

The requirement sections are:

- **Requirement 2.1:** Processes and mechanisms for applying secure configurations to all system components are both defined and understood.
- **Requirement 2.2:** System components are configured and managed securely.
- **Requirement 2.3:** Wireless environments are configured and managed securely. 

### Requirement 2.1: Processes and mechanisms for applying secure configurations to all system components are defined and understood.

This requirement focuses on managing and maintaining the various policies and procedures specified throughout PCI DSS requirement 2. It is required that these policies are both outlined clearly and properly documented, maintained, and shared with everyone involved so that the critical system components are implemented.

- **Requirement 2.1.1:** All security policies and operational procedures identified in Requirement 2 are documented, kept up-to-date, in use, and known to all impacted parties.
- **Requirement 2.1.2:** Roles and responsibilities for performing activities in Requirement 2 are documented, assigned, and understood by all parties.

### Requirement 2.2: System components are configured and managed securely.

This section focuses on configuring system components to keep attacks to a minimum. Many operating systems, databases, network devices, software, and applications have known weaknesses that, when configured to reduce security vulnerabilities, minimize the attack vectors available. 

Because attackers try vendor default account names and passwords - which are often published and well known - to compromise systems, one such change is to update vendor accounts from the default names and passwords.

Likewise, by removing or disabling all unnecessary services and functions, organizations can secure the functions that are required and reduce the risk that unknown or unnecessary functions will be exploited. 

- **Requirement 2.2.1:** Configuration standards are implemented and maintained to cover all systems; they address all known security vulnerabilities; and are updated as new vulnerabilities arise.
- **Requirement 2.2.2:** If vendor default accounts are used, the default passwords are changed; otherwise, the default accounts are removed.
- **Requirement 2.2.3:** Primary functions requiring different security levels are managed such that only one primary function exists on a system component, any primary functions existing in the same system with dissimilar security levels are isolated from each other, or primary functions in the same system with dissimilar security levels are all secured to the level with the highest security need.
- **Requirement 2.2.4:** Only necessary services, protocols, and functions are enabled, and all unnecessary functionality is removed. 
- **Requirement 2.2.5:** If any insecure services or protocols are present, the business justification is documented, as well as any additional security features.
- **Requirement 2.2.6:** System security parameters are configured to prevent misuse.
- **Requirement 2.2.7:** All non-console administrative access is encrypted using strong cryptography. 

### Requirement 2.3: Wireless environments are configured and managed securely. 

This requirement focuses on the security of wireless environments, which are often the target of attacks.

If wireless networks are not implemented with sufficient security configuration (including changing the default settings), attackers can eavesdrop on the traffic, easily capture sensitive data, and enter and attack the network. 

Whenever someone with knowledge of encryption keys has changed roles or left the organization, or a key is suspected of having been compromised, the encryption keys should also be changed to protect the underlying data.

- **Requirement 2.3.1:** Any wireless environment connected to the [cardholder data environment (CDE)](https://blog.basistheory.com/cardholder-data-environment-guide) or transmitting account data should have all vendor defaults changed at installation or confirmed to be secure.
- **Requirement 2.3.2:** Any wireless environment connected to the CDE or transmitting account data should have wireless encryption keys changed whenever anyone with knowledge of the key leaves the company, or whenever a key is suspected to be compromised.

## How Basis Theory can help you Satisfy PCI DSS Requirement 2

Securing cardholder data in a CDE satisfies many PCI DSS requirements and provides companies greater control and flexibility over their [payment stack](https://blog.basistheory.com/multiple-payment-gateways-benefits). However, building and maintaining the necessary infrastructure and programs can require hundreds of thousands of dollars and months to implement and assess. Basis Theory provides the platform, infrastructure, and tools to secure cardholder data in minutes and without these costs and distractions.

As a PCI Level 1 compliant service provider, Basis Theory extends an independently assessed and approved CDE to customers. Combined with a suite of configurable tools, services, and tokens, companies can collect, secure, and share credit cards without bringing their systems into scope. This approach allows companies to avoid the costs and distractions associated with 95% of the requirements in the Payment Card Industry Data Security Standard (PCI DSS) while retaining complete control over their cardholder data.

\*PCI DSS Requirement information contained in this post is for educational purposes only and references material from the guide "Payment Card Industry Data Security Standard: Requirements and Testing Procedures, v4.0" published by the PCI SSC in March 2022. Please refer to the [PCI Security Standards Council website](https://www.pcisecuritystandards.org/) for the complete, up-to-date, accurate requirements.

[![View an Interactive Demo   See how the Basis Theory platform secures payment data and significantly reduces PCI compliance burden from day 1.  ](https://no-cache.hubspot.com/cta/default/22332934/interactive-171495116167.png)](https://blog.basistheory.com/hs/cta/wi/redirect?encryptedPayload=AVxigLLvj1mKNqKRaHK0P4Pt2KnWE3n1ZeIyoVFUCU3yHVKxLgXmT6zYOSN7MfAzlaO77VEGr5kTJOpz%2BCLvay1O2bWZ9b9sObKgFr9t0ooj6cCg5Iq8kKHJ9T3Ujq%2B4HROouwQndI5bx2fZ%2Fxd5egx%2BKYDypXsfykT6geArVy%2FAKs%2BQA1qX5yWas2W4i9yONF8Y%2FnJrX3Htvah1sB7uTtpcYgPVj%2FE%3D&webInteractiveContentId=171495116167&portalId=22332934)

## Related posts

[![PCI DSS Requirement 10: Track and Monitor Network Access](https://blog.basistheory.com/hubfs/pci-dss-requirement-10.png)](https://blog.basistheory.com/pci-dss-requirement-10)

[PCI Compliance](https://blog.basistheory.com/tag/pci-compliance)

### [PCI DSS Requirement 10: Track and Monitor Network Access](https://blog.basistheory.com/pci-dss-requirement-10)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 October 17, 2023

[Read more](https://blog.basistheory.com/pci-dss-requirement-10)

[![PCI DSS requirement 6: develop and maintain secure systems](https://blog.basistheory.com/hubfs/pci-dss-requirement-6.png)](https://blog.basistheory.com/pci-dss-requirement-6)

[PCI Compliance](https://blog.basistheory.com/tag/pci-compliance)

### [PCI DSS Requirement 6: Develop and Maintain Secure Systems](https://blog.basistheory.com/pci-dss-requirement-6)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 September 18, 2023

[Read more](https://blog.basistheory.com/pci-dss-requirement-6)

[![PCI DSS requirement 11](https://blog.basistheory.com/hubfs/pci-dss-requirement-11.png)](https://blog.basistheory.com/pci-dss-requirement-11)

[PCI Compliance](https://blog.basistheory.com/tag/pci-compliance)

### [PCI DSS Requirement 11: Test System & Network Security Regularly](https://blog.basistheory.com/pci-dss-requirement-11)

![Picture of Basis Theory](https://blog.basistheory.com/hs-fs/hubfs/bt-favicon-new.png?width=50&name=bt-favicon-new.png) [Basis Theory](https://blog.basistheory.com/author/basis-theory-team) 

 October 30, 2023

[Read more](https://blog.basistheory.com/pci-dss-requirement-11)

## Stay Connected

### Receive the latest updates straight to your inbox

### Follow on Social

<https://www.linkedin.com/comm/mynetwork/discovery-see-all?usecase=PEOPLE_FOLLOWS&followMember=colinthomasluce>

[![BTLogo (1)](https://blog.basistheory.com/hs-fs/hubfs/BTLogo%20(1).png?width=138&height=46&name=BTLogo%20(1).png "BTLogo (1)")](https://basistheory.com)

- Use Cases 
    - [Creator Economy](https://basistheory.com/use-cases/creator-economy)
    - [Digital Health](https://basistheory.com/use-cases/health)
    - [E-Commerce](https://basistheory.com/use-cases/ecommerce)
    - [Fintech](https://basistheory.com/use-cases/fintech)
    - [Gaming](https://basistheory.com/use-cases/gaming)
    - [Remittance](https://basistheory.com/use-cases/remittance)
    - [Subscription Platforms](https://basistheory.com/use-cases/subscriptions)
    - [Online Travel Agencies](https://basistheory.com/use-cases/travel)
    - [Vertical SaaS](https://basistheory.com/use-cases/vsaas)
- Developers 
    - [Quickstart](https://developers.basistheory.com/getting-started)
    - [Elements](https://developers.basistheory.com/docs/sdks/web/javascript)
    - [Documentation](https://developers.basistheory.com/)
- Basis Theory 
    - [Pricing](https://basistheory.com/pricing)
    - [Add-Ons](https://basistheory.com/add-ons)
    - [ROI Calculator](https://go.basistheory.com/roi)
    - [Case Studies](https://blog.basistheory.com/case-studies)
    - [Blog](https://blog.basistheory.com)
    - [Contact](https://basistheory.com/contact)
- Other 
    - [Terms and Conditions](https://basistheory.com/resources/terms-of-service)
    - [Privacy Policy](https://basistheory.com/resources/privacy-policy)
    - [Cookie Policy](https://basistheory.com/resources/cookie-policy)
    - [Security](https://basistheory.com/security)
    - [System Status](https://status.basistheory.com/)
- Compare 
    - [Basis Theory Vs. Evervault](https://go.basistheory.com/evervault-alternative)
    - [Basis Theory Vs. IXOPAY](https://go.basistheory.com/alternative-to-ixopay)
    - [Basis Theory Vs. VGS](https://go.basistheory.com/compare/very-good-security)

---

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Basis Theory",
    "url" : "https://blog.basistheory.com/author/basis-theory-team"
  },
  "dateModified" : "2025-05-23T20:19:49.891Z",
  "datePublished" : "2023-08-17T12:00:00.000Z",
  "headline" : "PCI DSS Requirement 2: Securely Configure System Components",
  "image" : [ "https://blog.basistheory.com/hubfs/pci-dss-requirement-2.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://blog.basistheory.com/pci-dss-requirement-2",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://blog.basistheory.com/hubfs/BTLogo%20(1).png"
    },
    "name" : "Basis Theory"
  }
}
```