Payment Card Industry Data Security Standard (PCI DSS)

The Payment Card Industry Data Security Standard (PCI DSS) is a set of technical and operational security requirements for every organization that stores, processes or transmits payment card data, or that can affect the security of that data. It applies to merchants of every size, to the payment processors, gateways and hosting firms that serve them, and to the banks that issue and acquire cards. Its purpose is to stop card numbers being stolen and used for fraud.

PCI DSS is written and maintained by the PCI Security Standards Council (PCI SSC), founded on 7 September 2006 by American Express, Discover, JCB, Mastercard and Visa. The council sets the standard, but it does not enforce it: compliance is required by the card networks through their rules and passed down to merchants by contract through their acquirer or payment service provider (PSP). It is an industry standard, not a law, although regulators and courts often treat it as a benchmark for reasonable security.

Think of PCI DSS as the building code for any place where card numbers are kept. A building code says the wiring must be safe and an inspector must sign off before people move in. PCI DSS does the same for computer systems: lock the doors, keep a list of who has keys, record who comes and goes, and get checked regularly.

The simplest way to follow the code is to keep as little card data as possible. A shop that never sees a real card number has far less to protect, much as a house with no gas supply never needs a gas inspection.

Before 2004 each card brand ran its own security programme, such as Visa's Cardholder Information Security Program. PCI DSS 1.0, released in December 2004, aligned them in one common standard, and the council took it over in 2006. Version 4.0 was published in March 2022, and version 4.0.1 followed in June 2024. Version 3.2.1 was retired on 31 March 2024 and version 4.0 on 31 December 2024, so 4.0.1 is the only active version as of 2026. A set of new requirements introduced in version 4.0 as "best practice" became mandatory on 31 March 2025. Among them are multi-factor authentication (MFA) for all access into the cardholder data environment, 12-character minimum passwords, and controls over scripts running on online payment pages, aimed at attacks that skim card details from checkout forms.

PCI DSS protects "account data", which has two parts. Cardholder data is the primary account number (PAN), the cardholder name, expiry date and service code. Sensitive authentication data is the full magnetic stripe or chip data, the card verification value (CVV) and the PIN; it must never be stored after a payment is authorized. The standard organizes its controls into six goals and twelve principal requirements:

1. Install and maintain network security controls.
2. Apply secure configurations to all system components.
3. Protect stored account data, for example by truncation, tokenization or strong encryption.
4. Protect cardholder data with strong cryptography, such as Transport Layer Security (TLS), when it crosses open, public networks.
5. Protect all systems and networks from malicious software.
6. Develop and maintain secure systems and software.
7. Restrict access to system components and cardholder data by business need to know.
8. Identify users and authenticate access to system components.
9. Restrict physical access to cardholder data.
10. Log and monitor all access to system components and cardholder data.
11. Test the security of systems and networks regularly.
12. Support information security with organizational policies and programmes.

Requirements 7 to 9 are, in effect, a detailed application of access control, authentication and authorization to card systems.

Card brands place merchants in levels by annual transaction volume; at Visa, Level 1 covers merchants with more than six million Visa transactions a year. Large merchants and service providers usually undergo an annual on-site assessment by a Qualified Security Assessor (QSA), who writes a Report on Compliance (ROC). Smaller merchants usually complete a Self-Assessment Questionnaire (SAQ); there are several SAQ types, from short ones for businesses that fully outsource card handling to long ones for those that store card data. Both routes end with an Attestation of Compliance (AOC), and internet-facing systems also need quarterly vulnerability scans by an Approved Scanning Vendor. Merchants report to their acquirer, which reports to the networks. A payment facilitator (PayFac) is itself a service provider and must validate its own compliance as well as oversee its sub-merchants.

Because the standard applies to every system that touches card data, or can affect systems that do, the cheapest route to compliance is to shrink that footprint. Common methods include:

• Hosted payment pages and fields. The payment gateway collects card details on its own page, so the merchant's website never receives them.
• Tokenization. Stored card numbers are swapped for tokens that are useless outside the payment system, including network tokens issued by the card schemes.
• Point-to-point encryption. End-to-end encryption of card data from the terminal to the processor keeps it unreadable on store networks.
• Network segmentation. Card systems are walled off from the rest of the business so that the office network is out of scope.

Because PCI DSS is contractual, the sanctions are commercial. Acquirers may charge monthly non-compliance fees, and after a breach the card networks can levy assessments for fraud losses and card reissuance, pass costs to the merchant through its acquirer, or end its ability to accept cards.

The standard has well-known limits. Compliance is a point-in-time check, and several large data breaches have hit companies that had passed an assessment months earlier. Critics also argue that its detail encourages box-ticking rather than real risk management. Supporters reply that it gave the industry a common baseline, helped end the storage of full stripe data, and pushed the market toward tokenization and encryption. It also sits alongside other duties: firms handling card data must still meet data privacy laws and manage third-party risk from the vendors that touch their payments.

• PCI Security Standards Council: PCI DSS
• PCI Security Standards Council