PCI Compliance
What is PCI compliance?
PCI compliance, or payment card industry compliance, is the process businesses follow to meet the Payment Card Industry Data Security Standard (PCI DSS). The PCI DSS contains 12 requirements that help businesses securely store, process and transmit cardholder data such as credit card numbers.
Major credit card companies require businesses that process credit card transactions or store cardholder data to follow the PCI DSS. By meeting the 12 PCI compliance requirements, companies can strengthen their cybersecurity stance and reduce the risk of losing cardholder data in a data breach.
Is there a PCI DSS certification?
Not formally. The PCI Security Standards Council (PCI SSC), which maintains the standard, doesn't issue certificates, so a business can't technically become PCI certified. Instead, businesses validate compliance. Larger organizations do this through an audit by a qualified security assessor (QSA), which produces a report on compliance (ROC) that the business submits to the banks that process its card payments. Smaller organizations validate through a self-assessment questionnaire (SAQ).
Who sets the standard for PCI?
Visa, Mastercard, Discover, American Express and JCB each had their own security programs in the early 2000s. They combined them into the first PCI DSS in December 2004 and formed the PCI SSC in 2006 to maintain it. The council also certifies QSAs, who assess compliance, and PCI forensic investigators (PFIs), who investigate breaches involving payment data.
The council released version 4.0 in March 2022 and a limited revision, version 4.0.1, in June 2024. Version 4.0.1 is now the only active version. Version 4.0 retired on December 31, 2024, and the requirements that were future-dated in version 4.0 became mandatory on March 31, 2025.
Who must comply with PCI?
Any organization that stores, processes or transmits cardholder data must comply, whatever its size or transaction volume. That includes online retailers, brick-and-mortar stores, businesses using mobile card readers and payments taken over the phone or written on an order form.
PCI DSS is an industry standard, not a law. It is enforced through card-brand rules and merchant agreements. Card brands can fine non-compliant businesses or bar them from accepting payments. Some states, like Nevada, Washington and Minnesota, have written parts of the standard into state law.
Many small businesses incorrectly believe that PCI DSS requirements don't apply to them because they use payment gateways, such as PayPal, Stripe or Square to limit their exposure to cardholder data and reduce the likelihood of a breach. But these businesses are still required to be PCI compliant in other ways, even if employees don't have direct access to credit card data.
PCI compliance levels
Card brands assign each merchant to one of four levels, usually by annual transaction volume. Thresholds vary by brand and are set by the brands and acquiring banks, not the PCI SSC. The levels below follow the commonly cited Visa model, and a merchant's acquiring bank confirms its level:
- Level 1. More than 6 million card transactions per year, or any merchant that has had a breach that compromised account data.
- Level 2. 1 million to 6 million transactions per year.
- Level 3. 20,000 to 1 million e-commerce transactions per year.
- Level 4. Fewer than 20,000 e-commerce transactions per year, or up to 1 million transactions per year through any channel.
A card brand can move a lower-volume business to Level 1 if it assesses the breach risk as high.
Each level validates compliance every year by submitting the document for its level: a self-assessment questionnaire (SAQ), an attestation of compliance (AOC), vulnerability scans by an approved scanning vendor (ASV) and, for the largest merchants, a report on compliance (ROC):
- Level 1. ROC completed by a QSA and quarterly ASV scans.
- Level 2. A ROC, or an SAQ and AOC depending on the credit card company, plus quarterly ASV scans.
- Level 3. An SAQ and AOC.
- Level 4. An SAQ and AOC if requested.
The 12 PCI DSS requirements
The 12 requirements below are based on PCI DSS v4.0.1. Each breaks down into more specific requirements and testing procedures that assessors use to validate compliance:
- Install and maintain network security controls.
- Apply secure configurations to all system components.
- Protect stored account data.
- Use strong cryptography to protect cardholder data in transit over open, public networks.
- Protect all systems and networks from malicious software.
- Develop and maintain secure systems and software.
- Restrict access to system components and cardholder data by business need-to-know.
- Identify users and authenticate access to system components.
- Restrict physical access to cardholder data.
- Log and monitor all access to system components and cardholder data.
- Test the security of systems and networks regularly.
- Support information security with organizational policies and programs.
Requirements 7, 8 and 10 are the access requirements: limit who can reach cardholder data, verify who they are and keep a record of what they did. They overlap with controls many organizations already run for SOC 2, HIPAA or SOX.
Businesses don't have to be fully compliant before they can accept card payments. Most businesses work toward it using the PCI SSC's prioritized approach, which organizes the work into six milestones, starting with reducing how much sensitive data is retained and ending with confirming that every control is in place.
Why PCI compliance matters
For businesses, compliance means putting security practices in place that protect payment data, reduce the chance of a breach and limit the damage, fines and fees when one happens. For card brands and banks, fewer breaches mean less fraud. For cardholders, it means a merchant that follows the standard is less likely to expose their data.
Compliance is not the same as security. Verizon's payment security research has found that many organizations that pass validation one year have let controls lapse by the next, and Level 4 businesses validate with a self-assessment rather than an external audit. Treat PCI DSS as a floor, not a full security program.
PCI compliance best practices
The PCI SSC publishes guidance on maintaining compliance between assessments. The practices that make the most difference:
- Build compliance into daily work. Run internal audits, keep logs and past assessments organized and test controls through the year so gaps show up before the annual assessment does.
- Document policies and procedures. Controls that live only in one person's head leave with that person.
- Assign ownership. Give named people responsibility for each control and limit administrative access to the people who need it.
- Monitor, test and fix controls continuously. A control that passed last year can fail quietly. When one does, contain the incident, restore the control, find the root cause and keep monitoring it.
- Watch third parties. Outsourcing payment processing to a Level 1 provider doesn't transfer liability. Monitor vendors' compliance as well as the organization's own.
- Train staff. Most exposure of cardholder data comes from people storing it where they shouldn't or falling for phishing.
More PCI compliance resources
Blogs