PCI Security Standards Council (PCI SSC) is the global body that writes and maintains the payment card industry's security standards, including PCI DSS, and qualifies the assessors who check compliance. Visa, Mastercard, American Express, Discover and JCB founded it in 2006 to replace five overlapping brand programmes; UnionPay later joined as a strategic member. Its family of standards also covers PIN-entry devices, PIN security, point-to-point encryption, payment software and 3-D Secure environments. It certifies Qualified Security Assessors, Approved Scanning Vendors and PCI Forensic Investigators, and publishes lists of approved devices and validated solutions. It does not enforce compliance, levy fines or set merchant levels; card brands and acquirers do. Buyers use its public registries to verify a target's claimed validations.
What is PCI Security Standards Council's role
Before 2006 each brand ran its own security programme, and a merchant accepting five brands faced overlapping rules. The founders merged them into one standard owned by a neutral council. The council sets the technical rules; the individual card brands still decide who must comply, by when, and what happens if they do not.
PCI SSC standards explained
PCI DSS is the best known, but the council publishes a family of standards, each aimed at a different part of the payment chain:
- PCI DSS: security of any environment that stores, processes or transmits card data.
- PIN Transaction Security (PTS) POI: physical and logical security of PIN-entry devices and card readers.
- PCI PIN Security: handling of PINs and encryption keys during processing.
- Point-to-Point Encryption (P2PE): validated encryption solutions from terminal to decryption environment.
- Secure Software Standard and Secure SLC: payment software and vendors' development processes, replacing the retired PA-DSS.
- 3DS Core Security Standard: security of the environments running 3-D Secure components.
- Card Production and Provisioning: physical and logical security at card manufacturers and personalisation bureaux.
What does PCI SSC do day to day
Beyond writing standards, the council runs qualification programmes. Qualified Security Assessors (QSAs) and Internal Security Assessors perform PCI DSS assessments; Approved Scanning Vendors run the mandatory external vulnerability scans; PCI Forensic Investigators are the firms brought in after a card data breach. The council also maintains public lists of approved PTS devices, validated P2PE solutions and validated software, and publishes guidance and FAQs that assessors treat as authoritative interpretation.
Participating Organizations, which include merchants, banks, processors and vendors, comment on drafts before each new version. PCI DSS v4.0 was published in 2022 and v4.0.1 is the current version.
What the council does not do
The PCI Security Standards Council does not enforce compliance, levy fines or decide a merchant's PCI compliance level. Those powers sit with the card brands and flow through acquirers' contracts. It is also not a government regulator: PCI DSS is contractual, while licensing of an EMI or PI is a matter for national authorities.
Why its registries matter to buyers
The council's public listings give a buyer an independent check. A target claiming to be a validated P2PE provider or to sell approved terminals should appear on the relevant list with a current, non-expired entry; a QSA named on an assessment should appear in the assessor directory.