PCI DSS (PCI DSS)
The Payment Card Industry Data Security Standard, required by card brands for anyone storing, processing or transmitting cardholder data.
Overview
PCI DSS sets requirements for network security, data protection, access control, monitoring and testing. Version 4.0 introduced more flexible, risk-based approaches. Compliance is validated through assessments and enforced through card-brand contracts.
As an industry standard it binds through regulation that cites it, contracts that require it or audits that test it. The authorities most closely connected to it are PCI SSC.
Check the official sources below for legal scope, applicable dates and exceptions. This entry is an explanatory reference, not legal advice.
Why it matters
It is a standard enforced by contract: fail it and you can lose the ability to accept cards.
Who it affects
Merchants, payment processors and service providers handling card data.
Where it sits
Ten linked steps connect where you operate to the proof that you complied.
- 01Jurisdiction
- 02Industry
- 03Activity
- 04Authority
- 05Regulation
- 06Requirement
- 07Guidance
- 08Control
- 09Evidence
- 10Enforcement
Connections
The terms most closely tied to PCI DSS. Select one to open it.
What to do about it
- 1Decide whether it applies through regulation, contract, audit or certification.
- 2Run a gap assessment against your current controls.
- 3Crosswalk it to the regulations and contracts that reference it.
- 4Collect evidence continuously for the audit period.
From requirement to evidence.
PCI DSS requirements are crosswalked to security controls already tested for other frameworks.
Request early access →