In order to meet the standard, organizations must protect cardholder data and maintain a secure network, implementing firewalls at every internet connection. They must implement strong access control measures and restrict access to cardholder data on a need-to-know basis, monitoring who has access to network resources and cardholder data. They must test security systems, security processes, and networks on a regular schedule, and regularly update anti-virus software. They must also maintain a vulnerability management program and information security policy.