PCI DSS
Payment Card Industry Data Security Standard
PCI DSS (Payment Card Industry Data Security Standard) is a global security standard that any organisation storing, processing, or transmitting payment card data must follow. Created by the major card brands, it defines technical and operational requirements — such as encryption, access control, and monitoring — to protect cardholder data and reduce payment fraud.
The standard is organised around a set of core requirements covering areas like building secure networks, protecting stored cardholder data, managing vulnerabilities, restricting access, and regularly monitoring and testing systems.
How an organisation validates compliance depends on its transaction volume, ranging from an annual Self-Assessment Questionnaire (SAQ) for smaller merchants to a formal on-site audit by a Qualified Security Assessor (QSA) for the largest. Reducing how much card data you handle directly is one of the most effective ways to lower PCI DSS scope.