What Is PCI DSS?

The Payment Card Industry Data Security Standard is the control set applying to organisations that store, process or transmit payment card data. It is contractual rather than statutory, enforced through the card brands and acquiring banks.

It is unusually prescriptive. Where most frameworks state objectives, this specifies requirements in technical detail, which makes it clearer to implement and harder to argue with.

What it requires, in outline

Network security controls and secure configuration. Protection of stored account data, including encryption and prohibition on storing certain elements at all. Encryption in transit across public networks.

Vulnerability management and secure development. Access control on a need-to-know basis with unique identification. Logging and monitoring. Regular testing. And an information security policy with supporting programmes.

Scope reduction is the main strategy

The standard applies to the cardholder data environment and to anything connected to it. Reducing what falls inside that boundary is the single most effective way to reduce cost and effort.

Tokenisation replaces card data with a reference of no value. Hosted payment pages and redirects move card entry to the provider's environment entirely. Segmentation isolates whatever remains. Together these can move an organisation from a substantial programme to a short questionnaire.

Version 4.0 and what changed

The current version introduced a customised approach, allowing organisations to meet an objective by a different means with documented analysis, alongside the prescriptive defined approach.

It also strengthened authentication requirements, added expectations around scripts on payment pages, and expanded requirements for service providers. Several requirements were phased in over time, which is worth checking against your assessment date.

Continuous compliance, not annual

The standard requires controls to operate continuously, and assessments increasingly examine evidence across the year rather than a snapshot.

An organisation that prepares for an assessment and relaxes afterwards is non-compliant for most of the year, which matters because the consequences of a breach are assessed against the state at the time of the breach, not at the last assessment.

What non-compliance actually costs

Fines levied through the acquirer, increased transaction costs, and in serious cases loss of the ability to accept cards — which for most businesses is existential.

Following a breach, forensic investigation by an approved investigator is mandatory and the findings determine liability for fraud losses and reissuance costs.

Compensating controls and the customised approach

Where a requirement cannot be met as written, a compensating control may be accepted: it must meet the intent, provide a similar level of defence, go beyond other requirements, and be documented with a risk analysis.

The current version added a broader customised approach for organisations with mature risk management, permitting a different means of meeting an objective with documented evidence of effectiveness. Both receive close assessor scrutiny, and neither is a route around a requirement that is simply inconvenient.

Where to start

Establish exactly where card data enters, flows and rests in your environment. That map determines your scope, and organisations regularly find data in places nobody expected.

See what is new in version 4.0. GuardsArm delivers PCI DSS compliance.