What is PCI DSS?
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security requirements for organisations that accept, process, store or transmit cardholder data. It is developed and maintained by the PCI Security Standards Council (PCI SSC). PCI DSS is not a law; the card brands require compliance contractually through acquiring banks. Check your acquirer's current rules for the validation and enforcement that apply to you.
Who PCI DSS applies to
If your organisation handles cardholder data, PCI DSS applies. That includes merchants, service providers, financial institutions and software developers that build payment applications or integrate with payment systems. Confirm the applicable requirements with your acquirer and, where relevant, your QSA.
PCI DSS v4.0.1
PCI DSS v4.0.1 is the current version of the standard. It retains the 12 requirements and six goals and includes the Customized Approach, targeted risk analysis and expanded authentication requirements. Check the current PCI SSC publication for the exact requirements, effective dates and transition rules.
Key features of v4.0.1
1. The Customized Approach — organisations may meet a control objective using alternative controls, provided they demonstrate that the custom controls meet the requirement's intent (PCI DSS v4.0.1, Customized Approach).
2. Targeted risk analysis — specific requirements call for a targeted risk analysis to set the frequency of an activity, such as log reviews, based on the entity's risk environment (PCI DSS v4.0.1, targeted risk analysis requirements).
3. Multi-factor authentication — MFA is required for all access into the cardholder data environment (PCI DSS v4.0.1, Requirement 8).
4. Authentication requirements — the standard sets minimum password length and related authentication requirements (PCI DSS v4.0.1, Requirement 8).
5. E-commerce requirements — payment page scripts must be inventoried and authorised, and changes to payment pages must be detected (PCI DSS v4.0.1, Requirements 6.4.3 and 11.6.1).
The 12 PCI DSS requirements
PCI DSS is organised into 12 requirements grouped under six goals:
Goal 1: Build and maintain a secure network and systems
Requirement 1: Install and maintain network security controls.
Deploy network security controls to protect the cardholder data environment (Requirement 1).
Requirement 2: Apply secure configurations to all system components.
Remove vendor-supplied defaults and harden system components before deployment (Requirement 2).
Goal 2: Protect cardholder data
Requirement 3: Protect stored account data.
Minimise storage and render the primary account number unreadable where it is stored, using methods the standard permits (Requirement 3).
Requirement 4: Protect cardholder data with strong cryptography during transmission over open, public networks.
Encrypt cardholder data in transit using strong cryptography; the standard sets the acceptable protocols (Requirement 4).
Goal 3: Maintain a vulnerability management programme
Requirement 5: Protect all systems and networks from malicious software.
Deploy anti-malware controls on systems the standard covers (Requirement 5).
Requirement 6: Develop and maintain secure systems and software.
Identify and address vulnerabilities, apply security patches within the timeframe the standard sets, and follow secure development practices for custom software (Requirement 6).
Goal 4: Implement strong access control measures
Requirement 7: Restrict access to system components and cardholder data by business need to know.
Limit access to the cardholder data environment to individuals whose job requires it (Requirement 7).
Requirement 8: Identify users and authenticate access to system components.
Assign unique IDs, apply the authentication and MFA requirements, and review access (Requirement 8).
Requirement 9: Restrict physical access to cardholder data.
Use physical security controls for systems that store, process or transmit cardholder data (Requirement 9).
Goal 5: Regularly monitor and test networks
Requirement 10: Log and monitor all access to system components and cardholder data.
Maintain audit trails and review them as the standard requires (Requirement 10).
Requirement 11: Test security of systems and networks regularly.
Run the vulnerability scans and penetration testing the standard requires, including authenticated internal scanning and payment-page change detection (Requirement 11).
Goal 6: Maintain an information security policy
Requirement 12: Support information security with organisational policies and programmes.
Maintain the information security policy and the supporting programmes the standard requires, including risk assessment, security awareness and service-provider management (Requirement 12).
Validation
The card brands set merchant and service-provider validation levels. PCI SSC publishes the Self-Assessment Questionnaires (SAQ) and the Report on Compliance (ROC) process. Confirm with your acquirer which validation instrument applies to you.
- SAQ — the self-assessment questionnaire for the merchant or service-provider category your acquirer confirms.
- ROC — the report on compliance completed by a Qualified Security Assessor (QSA) or Internal Security Assessor (ISA) where your acquirer requires it.
- AOC — the Attestation of Compliance submitted with the SAQ or ROC.
Preparing for validation
- Scope the cardholder data environment. Identify systems, people and processes that store, process or transmit cardholder data, and systems that can affect its security.
- Run a gap assessment against the applicable requirements and document the gaps.
- Remediate — implement, upgrade or reconfigure controls and update policies.
- Validate with the instrument your acquirer requires, including the scans and testing the standard sets.
- Submit the SAQ or ROC and AOC to your acquiring bank and keep the supporting evidence.
PCI DSS checklist
- [ ] Determine the validation level and instrument with your acquirer
- [ ] Define the cardholder data environment scope
- [ ] Implement and validate network segmentation
- [ ] Deploy network security controls (Requirement 1)
- [ ] Harden system components and remove vendor defaults (Requirement 2)
- [ ] Protect stored account data and minimise retention (Requirement 3)
- [ ] Encrypt cardholder data in transit (Requirement 4)
- [ ] Deploy and maintain anti-malware controls (Requirement 5)
- [ ] Maintain secure development and patching processes (Requirement 6)
- [ ] Implement role-based access control (Requirement 7)
- [ ] Apply the authentication and MFA requirements (Requirement 8)
- [ ] Restrict and monitor physical access (Requirement 9)
- [ ] Implement logging and log review (Requirement 10)
- [ ] Run the required scans and penetration tests (Requirement 11)
- [ ] Maintain the information security policy and supporting programmes (Requirement 12)
- [ ] Inventory and authorise payment page scripts (Requirements 6.4.3 and 11.6.1)
- [ ] Perform targeted risk analyses where the standard requires them
- [ ] Document service-provider relationships
- [ ] Submit the SAQ or ROC and AOC to your acquirer
How Compliance Enablers supports PCI DSS
PCI DSS v4.0.1 is one of Compliance Enablers' 30 standards, run as a guided programme: scoping, assessment, scoring, evidence and readiness. The platform includes 60 dashboard modules in 11 groups, all included in every plan. Controls, evidence and findings map across standards through thousands of curated crosswalk mappings. PCI DSS is a licensed standard: it opens only after the customer confirms in-app that they hold their own licence, and the platform records that confirmation. The platform works alongside your own licensed copy of the standard; we never sell or redistribute standard text. We help you prepare; the assessment decision belongs to your QSA and the card brands.