THREATNOIR
Subscribe
Control frameworks and standards

PCI DSS

The security standard for anyone who stores, processes or transmits payment card data, in 12 principal requirements.

Official source Published by PCI Security Standards Council. Summaries in our own words.

What it is

PCI DSS is the payment card industry's security standard for protecting cardholder data. It exists because the card brands require every organisation that handles card data to meet a common set of technical and operational requirements.

Who it applies to

  • Merchants that accept card payments, from small shops to large online retailers
  • Service providers that store, process or transmit card data or can affect its security, such as payment gateways and hosting providers
  • Organisations whose systems connect to the cardholder data environment
  • Validation effort depends on merchant or service provider level, which the card brands set mainly by annual transaction volume
Status
A contractual industry standard owned by the PCI Security Standards Council. Version 4.0.1 (2024) is current; requirements that were future dated in version 4.0 became mandatory on 31 March 2025.
Enforcement
Enforced through contracts: card brands require compliance via the acquiring banks, which can impose fees, fines or end card acceptance after non-compliance or a breach. Validation is by a Report on Compliance from a Qualified Security Assessor or a Self-Assessment Questionnaire, depending on level.

Key points

  • Scope is everything: reducing where card data flows, for example through tokenisation or outsourced payment pages, reduces the work
  • Version 4.x allows a customised approach, where you show how a control meets the stated objective in another way
  • Targeted risk analyses now set the frequency of several activities instead of fixed intervals
  • Multi-factor authentication is required for all access into the cardholder data environment
  • E-commerce merchants must manage and monitor scripts on payment pages to detect tampering
  • Using a compliant service provider does not remove your responsibility: track which requirements each provider covers

Where to start

  1. 1Map where card data is stored, processed and transmitted, and minimise it
  2. 2Ask your acquirer which validation method and SAQ type apply to you
  3. 3Gap assess against v4.0.1, with attention to the requirements that became mandatory in March 2025
  4. 4Collect provider attestations of compliance and a responsibility matrix for each service provider

How it is structured

6 goals, 12 principal requirementsGrouped from secure networks and protecting account data to monitoring, testing and security policy
AppendicesAdditional requirements for multi-tenant service providers, SSL and early TLS, and designated entities
Self-Assessment QuestionnairesShorter validation forms for eligible merchants and service providers

A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.

Items explained (12)

In the order of the framework itself.