Below is a snippet, and a link to a full article which goes into some depth to explain this. What's not in the article is the requirement to keep credit card data on a separate server - but this is how it is being applied in practice:
Payment Card Industry Data Security Standard
Build and Maintain a Secure NetworkRequirement
1: Install and maintain a firewall configuration to protect data Requirement
2: Do not use vendor-supplied defaults for system passwords and other security parameters Protect Cardholder Data Requirement
3: Protect stored dataRequirement
4: Encrypt transmission of cardholder data and sensitive information across public networksMaintain a Vulnerability Management Program Requirement
5: Use and regularly update anti-virus softwareRequirement
6: Develop and maintain secure systems and applicationsImplement Strong Access Control Measures Requirement
7: Restrict access to data by business need-to-knowRequirement
8: Assign a unique ID to each person with computer accessRequirement
9: Restrict physical access to cardholder dataRegularly Monitor and Test NetworksRequirement
10: Track and monitor all access to network resources and cardholder dataRequirement
11: Regularly test security systems and processes.Maintain an Information Security PolicyRequirement
12: Maintain a policy that addresses information
The devil is in the detail, some of which is listed in the full article:

http://64.233.183.104/search?q=cache...k&ct=clnk&cd=1

And this quote from Protx:

Recently Visa, MasterCard and other major card schemes have introduced security audits to ensure that all merchants who collect credit card data comply with strict guidelines surrounding the collection and storage of credit card data.

VSP Direct merchants collect credit card data on their own website and will be asked by their bank to undergo an audit to ensure that data is kept secure at all times.

Alternatively, if you do not wish to undergo such an audit, then you can outsource the collection of credit card data to Protx, by using VSP Form or VSP Server.
Vger