PCI DSS 6.6 became a mandatory requirement on 30 June 2008.

 

Any type of company in business of processing, storing and transmitting cardholder and transaction data (e.g. merchants, banks, processors, and point-of-sale vendors) must protect their web applications by auditing their code or by deploying a web application firewall to be PCI DSS-compliant. This is a necessary requirement in order to become authorized to process credit card payments.