PCI DSS

The security standard every business that touches credit card data has to follow.

If a company accepts, stores, or sends card numbers, it has to meet a common set of security rules to protect them.

The Payment Card Industry Data Security Standard, a set of technical and operational requirements for any organization that accepts, processes, stores, or transmits cardholder data, enforced by the card networks rather than a government regulator. Cardholder data is the information on a payment card, such as the card number and expiry date.

The standard is maintained by the PCI Security Standards Council, which was founded by the major card brands, and it is organized around 12 main requirements that fall into broad goals:

• Secure networks and systems, such as firewalls and secure configurations.
• Protect account data, such as encryption of stored and transmitted card data.
• Manage vulnerabilities, such as regular updates and malware protection.
• Control access, such as limiting who can see card data and requiring strong authentication.
• Monitor and test, such as logging activity and testing security regularly.
• Maintain policies, such as a documented information security policy.

How a business proves compliance depends on its size and how it handles card data:

1. Smaller businesses often complete a self-assessment questionnaire.
2. Larger businesses typically undergo an assessment by a qualified assessor.
3. Businesses reduce the scope of what they must secure by not storing card data, for example by using tokenization, which replaces a card number with a stand-in value.

PCI DSS sits next to terms that are easy to mix up:

• SOC 2 is an audit report on a vendor's controls, while PCI DSS is a specific standard for card data.
• GDPR is a government-enforced privacy law, while PCI DSS is enforced through the card networks and the banks that process payments.
• Data residency is about where data is stored, which is a separate question from how card data is protected.