What Is PCI DSS?
The Payment Card Industry Data Security Standard
What is PCI DSS? It stands for the Payment Card Industry Data Security Standard, a set of security requirements for any organization that stores, processes or transmits payment card data, or that can affect the security of that data. The PCI Security Standards Council, whose founding members are the major card brands, created it.
The standard is not a law in itself. It is enforced through contracts. Card brands require acquiring banks to make sure their merchants comply, and the banks pass that obligation on to merchants and their service providers. A business that falls short may face fines through its bank, higher fees, or in serious cases the loss of its ability to accept cards.
Main Requirement Areas and Who Must Comply
The standard groups its requirements into broad goals. These include building and maintaining a secure network, protecting stored cardholder data, encrypting cardholder data sent across open networks, running a vulnerability management program, restricting access on a need-to-know basis, monitoring and testing networks, and maintaining an information security policy.
Compliance covers the whole environment that touches card data, not only the payment page. A shop's web server, database, plugins, administrator accounts and backups can all be in scope. Which requirements apply depends on how the shop accepts payments, which is why the self-assessment questionnaire type matters. See PCI SAQ types explained for how that is decided.
Merchant Levels and Ongoing Compliance
Card brands and acquiring banks place merchants into levels, based mainly on annual card transaction volume. The highest level requires the most demanding validation, typically an audit by a qualified security assessor. Smaller merchants usually complete a self-assessment questionnaire instead. Each brand and acquirer sets its own thresholds, so a shop should confirm its level with its bank.
Compliance is not a one-time certificate. Regular scans, access reviews and staff training must be kept up throughout the year, and the standard itself is updated from time to time. Tokenization can reduce the card data that falls within scope, as explained in payment tokenization.
Frequently asked questions
Does a small online shop have to follow PCI DSS?
Yes, if it accepts card payments. Business size does not exempt a shop. Smaller merchants usually have lighter obligations, typically a self-assessment questionnaire, and a shop that fully outsources card handling to a hosted payment page has the least to do. Its acquirer or payment provider can confirm what applies.
Is PCI DSS a law?
No. PCI DSS is an industry standard rather than legislation. It is enforced through the contracts that merchants sign with their acquiring banks and payment providers. Local data protection laws, such as those covering personal data, are separate and may also apply to a shop that takes card payments.