Hire a Virtual CISO

Glossary Term

PCI-DSS

The Payment Card Industry Data Security Standard, a set of security requirements for any organization that stores, processes, or transmits cardholder data from major payment card brands.

Understanding PCI-DSS

PCI-DSS (Payment Card Industry Data Security Standard) is a set of security standards established by the PCI Security Standards Council, founded by Visa, Mastercard, American Express, Discover, and JCB. Any organization that accepts, processes, stores, or transmits credit card information must comply with PCI-DSS, regardless of size or transaction volume.

Non-compliance can result in fines from payment processors, increased transaction fees, and in severe cases, loss of the ability to accept credit card payments. Beyond fines, a cardholder data breach triggers costly notification requirements, forensic investigations, and reputational damage.

The most effective strategy for PCI-DSS compliance is scope reduction. By using tokenization, point-to-point encryption, and hosted payment pages, organizations can dramatically reduce the number of systems that are in scope for PCI-DSS, reducing both cost and complexity.

The 12 Requirements

1Install and maintain network security controls (firewalls)
2Apply secure configurations to all system components
3Protect stored account data with encryption
4Protect cardholder data with strong cryptography during transmission
5Protect all systems and networks from malicious software
6Develop and maintain secure systems and software
7Restrict access to cardholder data by business need-to-know
8Identify users and authenticate access to system components
9Restrict physical access to cardholder data
10Log and monitor all access to system components and cardholder data
11Test security of systems and networks regularly
12Support information security with organizational policies and programs

Compliance Levels

Level 1

Over 6 million transactions per year. Requires annual on-site audit by QSA.

Level 2

1-6 million transactions per year. Annual self-assessment questionnaire (SAQ) required.

Level 3

20,000-1 million e-commerce transactions per year. Annual SAQ required.

Level 4

Fewer than 20,000 e-commerce or up to 1 million other transactions. Annual SAQ recommended.

Need PCI-DSS Compliance Help?

Our vCISOs guide organizations through PCI-DSS scope reduction and compliance.