PCI DSS
Payment Card Industry Data Security Standard
PCI DSS (Payment Card Industry Data Security Standard) is a global security standard that any organisation storing, processing, or transmitting payment card data must follow. Created by the major card brands, it defines technical and operational requirements — such as encryption, access control, and monitoring — to protect cardholder data and reduce payment fraud.
The standard is organised around a set of core requirements covering areas like building secure networks, protecting stored cardholder data, managing vulnerabilities, restricting access, and regularly monitoring and testing systems.
How an organisation validates compliance depends on its transaction volume, ranging from an annual Self-Assessment Questionnaire (SAQ) for smaller merchants to a formal on-site audit by a Qualified Security Assessor (QSA) for the largest. Reducing how much card data you handle directly is one of the most effective ways to lower PCI DSS scope.
Practical context
Using PCI DSS in a real decision
Definitions are most useful when they help a team decide what to scope, who should own the work, and what evidence supports the next step. Use these questions to turn the term into a practical conversation.
- Which customers, data, services, or contracts make this requirement relevant?
- What controls and evidence would demonstrate that the requirement is operating in practice?
- Who is accountable for the scope, reviews, and any remediation work?