PCI DSS

PCI DSS
Name	Payment Card Industry Data Security Standard
Status	Active
Version	4.0 (March 2022)
Organization	PCI Security Standards Council
Related standards	ISO/IEC 27001, PA-DSS, PCI PTS
Domain	Payment card data security
Website	https://www.pcisecuritystandards.org/

PCI DSS. The Payment Card Industry Data Security Standard is a global information security standard designed to reduce payment card fraud by increasing controls around cardholder data. Established by the major payment card brands, it mandates security measures for any entity that stores, processes, or transmits credit card information. Compliance is enforced by the payment card networks through their agreements with merchants, financial institutions, and service providers.

Overview

The standard was created to unify the separate security programs of founding members like Visa Inc., Mastercard, American Express, Discover Financial, and JCB. Administered by the PCI Security Standards Council, it provides a baseline of technical and operational requirements to protect account data. Its scope encompasses the entire payment ecosystem, from large retailers and banks to small e-commerce sites and third-party processors. Non-compliance can result in significant fines from acquirers and increased risk of data breaches, as seen in incidents involving Target Corporation and Heartland Payment Systems.

Requirements

The standard is organized into twelve high-level requirements grouped around six core goals. These include building and maintaining a secure network infrastructure, often involving firewalls and system passwords, and protecting cardholder data through measures like encryption and tokenization. Key mandates involve implementing strong access control measures, regularly monitoring and testing computer networks, and maintaining an information security policy. Specific controls address vulnerability management, intrusion detection systems, and restricting physical access to data centers.

Compliance process

Organizations validate compliance through an annual assessment, the method of which depends on their compliance level. For many large entities, this involves an onsite audit conducted by a Qualified Security Assessor and a subsequent Report on Compliance submitted to the acquiring bank. Alternatively, companies may complete a Self-Assessment Questionnaire and perform regular network scans by an Approved Scanning Vendor. The PCI Security Standards Council maintains lists of certified QSA companies and ASVs. Ongoing compliance requires continuous monitoring and adherence to the PCI DSS Security Audit Procedures.

Levels of compliance

Validation requirements are tiered based on transaction volume over a twelve-month period, with thresholds set by individual payment card brands. Merchant level 1, typically assigned to entities processing over six million transactions annually, requires the most rigorous external audit. Service provider levels have separate criteria for organizations like payment gateways or cloud computing providers that handle data on behalf of others. The Merchant levels system ensures that the largest entities, such as Walmart or Amazon.com, undergo the most stringent scrutiny, while smaller businesses have streamlined validation options.

Related standards and frameworks

The PCI Security Standards Council governs several adjunct standards. The PCI PIN Transaction Security standard covers devices used to accept personal identification numbers, while the PCI Point-to-Point Encryption standard aims to reduce the scope of PCI DSS assessments. For software developers, the now-retired Payment Application Data Security Standard was superseded by the Software Security Framework. Many organizations align their efforts with broader frameworks like ISO/IEC 27001, the NIST Cybersecurity Framework, or the Center for Internet Security CIS Controls.

History and development

Prior to its formation, individual payment card brands like Visa had their own programs, such as the Cardholder Information Security Program. In 2004, these brands aligned to create a unified standard, forming the PCI Security Standards Council in 2006 to manage it. Major versions have included PCI DSS 1.0, PCI DSS 3.0, and the current PCI DSS 4.0, released in March 2022. The evolution of the standard has been influenced by emerging threats, changes in technology like mobile payments and cloud services, and high-profile breaches at companies like TJX Companies.

Category:Computer security standards Category:Payment systems Category:Financial regulation