PCI DSS

PCI DSS
Name	PCI DSS
Caption	Payment Card Industry Data Security Standard logo
Established	2004
Owner	PCI Security Standards Council
Jurisdiction	Global

PCI DSS The Payment Card Industry Data Security Standard is a set of technical and operational requirements for organizations that process, store, or transmit cardholder data. It is maintained by the PCI Security Standards Council and is referenced by major payment brands such as Visa, Mastercard, American Express, Discover Financial Services, and JCB. The standard influences security programs across financial institutions like Bank of America, Citigroup, and Wells Fargo and intersects with regulatory frameworks such as Gramm–Leach–Bliley Act, Sarbanes–Oxley Act, and General Data Protection Regulation.

Overview

PCI DSS defines controls to protect cardholder data through requirements covering network architecture, cryptography, access control, monitoring, and policies. Organizations including merchants like Walmart, Amazon (company), and Starbucks Corporation and service providers such as Stripe (company), PayPal, and Square, Inc. use the standard alongside frameworks from National Institute of Standards and Technology, International Organization for Standardization, and Center for Internet Security. The Council, formed by payment brands and overseen by bodies like IBM, Deloitte, and Accenture, issues versions that align with industry events such as data breaches at Target Corporation, Home Depot, and Equifax.

History and Development

Initial specifications emerged after high-profile incidents and collaborations among payment brands including Visa, Mastercard, and American Express following breaches involving retailers like TJX Companies and processors such as Heartland Payment Systems. The PCI Security Standards Council, founded by founding members Visa, Mastercard, American Express, Discover Financial Services, and JCB, has released iterative versions influenced by research from institutions including MIT, Carnegie Mellon University, and SANS Institute. Major updates responded to technological shifts introduced by companies such as Apple Inc. and Google LLC and to standards from bodies like Internet Engineering Task Force and European Banking Authority.

Requirements and Control Objectives

The standard comprises control objectives mapped to requirements covering areas like firewall configuration, default password management, protection of stored data, encryption of transmitted data, vulnerability management, access control, logging, and information security policies. These requirements reference cryptographic guidelines from National Institute of Standards and Technology publications, authentication models debated in forums with Microsoft Corporation, Cisco Systems, and Oracle Corporation, and logging practices similar to those used by Splunk Inc. and McAfee, LLC. Control objectives intersect with audit practices employed by firms such as KPMG, PricewaterhouseCoopers, and Ernst & Young.

Compliance Assessment and Validation

Validation mechanisms include self-assessment questionnaires for smaller merchants and assessments by qualified assessors for large processors, often performed by firms like Trustwave, SecurityMetrics, and Coalfire. The Council maintains a program of qualified security assessors and forensic investigators with oversight comparable to accreditation models used by International Organization for Standardization and American National Standards Institute. Enforcement often involves payment brands and acquirers such as First Data Corporation and Global Payments Inc., and consequences for noncompliance have paralleled legal and regulatory actions seen in cases involving Target Corporation and Home Depot.

Implementation and Best Practices

Implementations recommend segmentation architectures used by enterprises like Amazon Web Services, Microsoft Azure, and Google Cloud Platform and cryptographic practices suggested by RSA Security LLC. Best practices include deploying network controls from vendors such as Cisco Systems, endpoint protections from Symantec Corporation, and logging solutions by Splunk Inc. or Elastic NV. Organizations adopt program governance structures similar to those at Procter & Gamble, Johnson & Johnson, and General Electric and often align incident response playbooks with guidance from Federal Bureau of Investigation, United States Secret Service, and industry groups including Financial Services Information Sharing and Analysis Center.

Criticisms and Limitations

Critics argue that compliance can be treated as check-box activity, similar critiques leveled at frameworks like ISO/IEC 27001 and SOC 2, and that prescriptive requirements may lag threats exemplified by incidents involving Equifax and SolarWinds. Smaller merchants have cited cost and complexity issues reminiscent of debates around Sarbanes–Oxley Act compliance, while researchers from Stanford University, University of Cambridge, and Imperial College London have published analyses questioning efficacy against advanced persistent threats. Debates continue among stakeholders including PCI Security Standards Council, payment brands, large acquirers such as JPMorgan Chase, and security vendors like CrowdStrike and Palo Alto Networks.

Category:Payment systems Category:Information security standards