PCI DSS (Payment Card Industry Data Security Standard) is a mandatory standard comprising security requirements through which all businesses that process, store or transmit card data create a secure environment for card transactions.
PCI DSS is created and maintained by the PCI Security Standards Council (PCI SSC), an independent body established by Visa, MasterCard, American Express, Discover and JCB. The first edition of PCI DSS was released on 7 September 2006 to manage PCI security standards and improve user security throughout the transaction process.
Businesses are responsible for compliance with the PCI standard, and the PCI Council manages the security standards. Card companies and banks enforce alignment with PCI Security Standards.
Under PCI DSS, any business that processes, stores or transmits credit card data must comply with the standard. The requirements also concern software developers and manufacturers of applications and devices used in such transactions.
The 12 PCI DSS requirements
PCI DSS requirements are divided into 12 main areas.
- Install and maintain firewalls
- Do not use default access credentials and settings
- Protect credit card data
- Encrypt credit card data during transmission over public networks
- Use and update antivirus software
- Develop and maintain secure applications
- Restrict access to data
- Assign unique IDs to users
- Restrict physical access
- Log and monitor access at network level
- Regularly test system security
- Maintain a security policy
How are you classified under PCI DSS?
Merchants
Merchants are businesses that receive credit card numbers to sell their own goods or services, typically using a service provider. An example is a hotel that uses booking.com to receive reservations with the customer's card details and a bank to complete the transaction.
Explore merchant categoriesService Providers
Service providers are businesses that do not receive credit cards directly for their own use, but generally do so to provide a service to a merchant: credit card payments on behalf of third parties. Examples include PayPal and Booking.com.
More about service providersHow much does it cost?
Would you like to know how much your certification costs?
What determines the cost?Why is PCI DSS important?
Card issuers continuously monitor account data breaches and take corresponding action. A security breach and loss of credit card data can have extensive consequences for your business, including:
- Financial penalties and fines
- Damage to the business's reputation
- Falling sales due to inability to accept cards
- Legal consequences arising from PSD2, which now requires businesses to protect their customers financially
- Temporary or permanent suspension of the ability to accept credit cards
- Increased compliance costs as the business is automatically upgraded to Level 1
Would you like to know your certification type and cost?
Cost calculation tool
Use the certification selection tool to calculate your certification type and annual cost.
Find your certification typeTalk to a PCI expert