PCI DSS (Payment Card Industry Data Security Standard) is the security standard every business that stores, processes or transmits cardholder data must meet, from a single-terminal shop to a global processor. The PCI Security Standards Council writes it; card brand rules and acquirer contracts, not law, enforce it. It protects the PAN, cardholder name, expiry date and service code, and bans storing sensitive authentication data such as CVV after authorization. Version 4.0.1 sets twelve requirements under six goals. Compliance is validated annually through a Qualified Security Assessor or a Self-Assessment Questionnaire, both ending in an Attestation of Compliance. Tokenization and hosted payment pages shrink scope; breaches at non-compliant firms bring fines, forensic costs and reissuance claims.
What is PCI DSS protecting
The standard covers cardholder data (the PAN, cardholder name, expiry date and service code) and sensitive authentication data (full track data, CVV/CVC, PINs). The PAN may be stored if rendered unreadable; sensitive authentication data may not be stored after authorization at all. Every system that holds this data, or can connect to one that does, is in scope as the cardholder data environment.
What are PCI DSS requirements
Version 4.0.1 keeps twelve requirements grouped under six goals:
- Install and maintain network security controls.
- Apply secure configurations.
- Protect stored account data.
- Encrypt cardholder data in transmission over open networks.
- Protect systems against malicious software.
- Develop and maintain secure systems and software.
- Restrict access by business need to know.
- Identify users and authenticate access.
- Restrict physical access to cardholder data.
- Log and monitor all access.
- Test security regularly, including penetration testing.
- Support security with policies and programmes.
Version 4.0 was retired on 31 December 2024, and its future-dated requirements became mandatory on 31 March 2025. Among them: multi-factor authentication for all access into the cardholder data environment and controls against script tampering on payment pages.
How does PCI DSS compliance work
Compliance is validated every year. The acquirer assigns a PCI compliance level based on transaction volume; large merchants and service providers get an assessment by a Qualified Security Assessor, smaller ones fill in a Self-Assessment Questionnaire. Both end in an Attestation of Compliance. Quarterly external scans by an Approved Scanning Vendor apply to most merchants with internet-facing systems.
Reducing scope is the main cost lever. A merchant using tokenization and a hosted payment page may qualify for the short SAQ A instead of SAQ D, which covers every applicable requirement.
PA-DSS vs PCI DSS
PA-DSS validated payment software sold to merchants, while PCI DSS applies to the organisation running it. PA-DSS was retired and its listing expired on 28 October 2022; software is now assessed under the PCI Secure Software Standard. Using validated software never made a merchant compliant on its own.
PCI DSS in due diligence
Non-compliance is not a crime, but brands can fine acquirers, who pass the cost on, and a breach at a non-compliant firm brings forensic investigation costs and card reissuance claims. Buyers of payment companies request the last ROC or SAQ, open remediation items and any past forensic reports.