Payment Card Industry Data Security Standard
A global contractual security standard mandated by the major card networks for any organisation that stores, processes or transmits cardholder data. Compliance is enforced through merchant agreements rather than government law.
Who it applies to
- Merchants and service providers that store, process or transmit cardholder data
- Organisations of any size accepting card payments, with scope-appropriate requirements
- Third parties with access to the cardholder data environment (CDE)
Key requirements
- Network segmentation and protection of the cardholder data environment
- Strong access control and authentication measures
- Annual internal and external penetration testing under Requirement 11.4
- Segmentation testing every 6 months for service providers
- Ongoing vulnerability management and secure system configuration
Maximum penaltyContractual fines from card networks/acquiring banks, increased transaction fees, or loss of card processing privileges
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Questions we get asked
PCI DSS applies to: Merchants and service providers that store, process or transmit cardholder data; Organisations of any size accepting card payments, with scope-appropriate requirements; Third parties with access to the cardholder data environment (CDE).
The core obligations are: Network segmentation and protection of the cardholder data environment; Strong access control and authentication measures; Annual internal and external penetration testing under Requirement 11.4; Segmentation testing every 6 months for service providers; Ongoing vulnerability management and secure system configuration. Each is summarised in plain English above, with a link to the official text.
Effective: Current version PCI DSS 4.0.1. Regulator: PCI Security Standards Council.
Contractual fines from card networks/acquiring banks, increased transaction fees, or loss of card processing privileges.
Praeferre's GRC Automation engine monitors the policies, document repositories and web pages that carry your risk under PCI DSS, on a cadence you set, and turns every scan into an audit trail you can put in front of an auditor or regulator. Alongside it, supplier and processor obligations run through Third-Party Risk Management.
See how Praeferre automates PCI DSS compliance
Continuous monitoring, evidence and reporting for PCI DSS — alongside every other framework you need to satisfy.