PCI DSS is the Payment Card Industry Data Security Standard from the PCI Security Standards Council. It applies to any business that accepts payment cards or stores or processes or transmits cardholder data. Six goals group 12 requirements. Validation depends on transaction volume and ranges from a self assessment to an on site assessment.
Card brands and banks ask merchants to prove they protect card data. PCI DSS is the standard behind that request.
Facts follow the PCI Security Standards Council and its Getting Started with PCI DSS guide.
What is PCI DSS Compliance?
PCI SSC describes PCI DSS as a baseline of technical and operational requirements designed to protect payment account data. It was developed to strengthen card data security and encourage consistent measures worldwide.
PCI SSC references the v4.x series of the standard. Check the Document Library for the version that your acquirer expects.
Who Must Follow PCI DSS?
PCI DSS applies to entities that store or process or transmit cardholder data or sensitive authentication data. It also applies to entities that could affect the security of the cardholder data environment. Merchants and processors and acquirers and issuers and service providers all fall in scope.
Payment brands and acquirers decide who must validate compliance and how. Your liability extends to third parties in your payment flow so confirm their status too.
What are the Six Goals and 12 Requirements?
| Goal | Requirements (Getting Started Wording) |
|---|---|
| Build and maintain a secure network | 1 Firewall configuration. 2 No vendor default passwords |
| Protect cardholder data | 3 Protect stored data. 4 Encrypt transmission across open networks |
| Maintain vulnerability management | 5 Anti virus software. 6 Secure systems and applications |
| Implement access control | 7 Need to know access. 8 Unique ID per person. 9 Physical access limits |
| Monitor and test networks | 10 Track access. 11 Test security systems |
| Maintain a security policy | 12 Policy for all personnel |
Newer versions rename some requirements. Use the current standard for audits.
How do You Validate Compliance?
- Self Assessment Questionnaire. Eligible merchants and service providers fill in one of the types A, B, C-VT, C or D that suits their payment setup.
- On site assessment. Larger businesses use a Qualified Security Assessor and submit findings to every acquirer.
- Quarterly scans. Some entities submit scan reports from an Approved Scanning Vendor.
- Annual attestation. Smaller businesses may submit an attestation within the questionnaire.
Related compliance guides include HIPAA compliance and cloud data protection controls and identity and access management.
Frequently Asked Questions
What does PCI DSS Mean?
It stands for Payment Card Industry Data Security Standard.
Who Maintains PCI DSS?
PCI SSC maintains the standard.
Does PCI DSS Apply to Small Businesses?
Yes. PCI SSC guidance states it applies to any business of any size that accepts payment cards.
How Many Requirements are in PCI DSS?
Its Getting Started guide lists 12 requirements under six goals.
Who Decides How I Validate?
Payment brands and acquirers decide who validates compliance and how.
Key Takeaways
- PCI DSS protects payment account data.
- It applies to any business that accepts payment cards.
- Six goals group 12 requirements.
- Validation depends on transaction volume.
- Confirm that third parties in your payment flow comply too.
Sources and References
Facts follow PCI SSC publications.
- PCI DSS (PCI SSC) www.pcisecuritystandards.org
- Getting Started with PCI DSS (PCI SSC) listings.pcisecuritystandards.org