Information security
Payment Card Industry Data Security Standard
Published Reviewed
What is PCI DSS?
PCI DSS is an industry security standard for organisations that store, process or transmit payment-card account data and for systems that can affect its security.
| Jurisdiction | Global industry standard |
|---|---|
| Authority | PCI DSS v4.0.1 |
| Current status | Current version published June 2024 |
| Reviewed |
Why it matters operationally
PCI DSS is not legislation — it binds through your card-scheme and acquirer contracts, which makes it in some ways stricter: non-compliance means fines passed down by the acquirer, higher fees, or losing the ability to take card payments at all. Version 4 raised the bar substantially, and its future-dated requirements — the hard ones — became mandatory in March 2025. Scope is the whole game: every system that stores, processes, transmits or can affect the security of account data is in, until you architect it out.
Are you aware?
The dates that bind
v3.2.1 retired
PCI DSS v4 became the only assessable version. Assessments, SAQs and evidence built for 3.2.1 stopped counting.
The future-dated requirements became mandatory
The 50-plus v4 requirements that were best practice until March 2025 — including expanded MFA, automated log review, authenticated internal scanning and e-commerce script integrity — are assessed like everything else from that date.
ASV scans never stop
External vulnerability scans by an Approved Scanning Vendor run at least quarterly and after significant change — with passing results retained as evidence. A missed quarter is a compliance gap by itself.
Where to start
- 1
Draw the cardholder-data environment: every flow of account data, every connected system — then shrink it with tokenisation, hosted payment pages and segmentation.
- 2
Determine your validation path — merchant level, SAQ type or full report on compliance — with your acquirer, not by assumption.
- 3
Put the recurring evidence on a calendar: quarterly scans, annual penetration tests, periodic control checks, and the targeted-risk-analysis cadence v4 introduced.
Authority links
Read the official sources
The official text is the authority. This guide is only a short orientation for operational planning.
Common questions
Frequently asked questions
Is PCI DSS a legal requirement?
It binds through contract — card-scheme rules flow through your acquirer agreement — rather than statute, though some jurisdictions reference it in law. Contractual enforcement is concrete: fines, fee increases and ultimately termination of card acceptance.
Does using a payment provider like Stripe or Adyen make us compliant?
It shrinks your scope, sometimes dramatically, but never to zero: your integration method (redirect vs embedded), your systems that touch account data, and your responsibility matrix with the provider decide which SAQ and which controls remain yours.
What changed most in version 4?
A customised-approach option for meeting requirements differently with evidence, MFA everywhere in the CDE, stronger e-commerce protections against script skimming, and targeted risk analyses that make some control frequencies yours to justify.
Key terms in this guide
A quick self-check
Are you ready?
- Could you produce your current network and data-flow diagrams of the cardholder-data environment today?
- Did all four ASV scans in the last twelve months pass — and can you show it?
- Do you know which v4 future-dated requirements applied to you when they became mandatory in March 2025?
Every question above has a written, evidence-backed answer in a well-run compliance record. If one made you pause, that pause is the gap.