PCI DSS

PCI DSS is the payment card industry’s security standard. The PCI Security Standards Council maintains it, and the card brands and acquiring banks enforce it. It applies to every organisation that stores, processes, or transmits cardholder data, and the first task in any programme is fixing exactly where that data lives, because scope decides the size of everything that follows.

Version 4.0 organises the standard into twelve requirement groups across six goals: network security controls, protected account data, vulnerability management, access control, monitoring and testing, and an information security policy. Each requirement states the evidence an assessor expects, from firewall rule reviews and stored-data inventories to multi-factor authentication records and quarterly scan results.

How an organisation validates depends on its transaction volume and the card brands’ merchant levels. Larger merchants work with a qualified security assessor and file a Report on Compliance. Smaller ones complete a self-assessment questionnaire matched to the way they take payments. Either way, external vulnerability scans by an approved scanning vendor run at least once a quarter.