Contractual industry standard
Global
PCI DSS
Payment Card Industry Data Security Standard
PCI DSS is the security standard for protecting payment card data. It isn't a law: card brands such as Visa and Mastercard require it through contracts with banks, which pass it on to merchants and service providers. Anyone who stores, processes or transmits cardholder data, or can affect its security, must comply. Version 4.0.1 is current, with 12 requirements, and all requirements introduced in version 4.0 have been mandatory since 31 March 2025.
Mandatory: Contractually required for anyone who stores, processes or transmits card data, or can affect its security
Quick facts
- What it covers
- Security of cardholder data and sensitive authentication data across networks, systems, applications, people and service providers.
- Who needs it
- Merchants, payment gateways, SaaS that store, process or transmit card data
- Why it matters
- E-commerce sites, SaaS platforms that take payments, and IT providers that host or support payment systems all fall in scope, and acquirers can fine or stop working with non-compliant businesses.
- Key requirements
- Network security controls and secure configurations (Requirements 1 and 2)
- Protect stored account data and encrypt it in transit (3 and 4)
- Anti-malware, secure systems and software, and script controls on payment pages (5 and 6)
- Need-to-know access, strong authentication with MFA, physical security (7 to 9)
- Logging, monitoring and regular security testing (10 and 11)
- Policies, risk analysis, awareness and third-party management (12)
- Where it applies
- Global
- Category
- Payment & Financial Data Security