https://www.pcisecuritystandards.org/documents/pci_dss_v2.pd..., PCI DSS 3.3 would seem to be the most applicable section here.