PCI DSS Compliance: Your Guide to Meeting Payment Card Industry Data Security Standards

What is PCI DSS compliance?

As the name suggests, PCI DSS compliance is adherence to the Payment Card Industry Data Security Standard (PCI DSS), which sets out global security requirements designed to protect payment card data and minimize card fraud.

Who maintains these standards? This is the role of the PCI Security Standards Council, which was established in 2006 by leading card brands, such as Visa, Mastercard, American Express, Discover, and JCB, to ensure card data was handled securely and consistently.  

Before PCI DSS, there was no universal security standard, and each bank or merchant had their own policies. As you can imagine, this was ineffective because protection was inconsistent. Many organizations depended on physical safeguards, which naturally meant digital security was weak and there was a high risk of data breaches. 

Enter PCI DSS — the answer to these issues. This unified standard protects cardholder data throughout its lifecycle and across the entire payment ecosystem, including preventing unauthorized access, reducing fraud, and limiting the impact of data breaches. 

In general, the data security standards are very black and white — organizations are expected to follow the specific steps and controls down to the letter, rather than it being merely outcome-focused. This has both advantages and downfalls: While it makes compliance easier to verify, it can be time-consuming and expensive to implement as, while not conceptually difficult, the requirements are extensive.  

As a result, some organizations attempt to avoid compliance until it is contractually enforced. But this is risky, because the consequences of non-compliance can be significant, from fines imposed by acquiring banks to the termination of card payment privileges. As penalties are privately enforced, they vary widely.
 
The bottom line is, it is not worth risking losses, especially since you must comply eventually.

Who does PCI DSS compliance apply to?

The data security standards apply principally to two main groups:

Merchants: Any organization that accepts card payments
Service providers: Businesses that store, process, transmit, or otherwise support cardholder data on behalf of merchants (e.g. hosting providers, payment gateways, software vendors, and other companies that often do not recognize themselves as part of the payment flow)

Requirements vary depending on annual transaction volume, merchant or service provider classification, and how cardholder data is handled. This adds complexity to the compliance process.

PCI DSS assessments

How can you assess whether you are compliant or not?

How you assess PCI DSS compliance depends on your organisation’s size, transaction volume, and risk profile.

Merchants

Lower-risk merchants may self-assess using a Self-Assessment Questionnaire (SAQ), such as SAQ A or SAQ B.

High-risk merchants, including those processing over 6 million transactions annually or those that have experienced a data breach, must undergo a full PCI DSS assessment.

This includes a Report on Compliance (ROC) conducted by a Qualified Security Assessor (QSA).

Service Providers

Most service providers are required to complete a full PCI DSS assessment.

An exception may apply if you process fewer than 300,000 transactions per year and are assessed as lower risk.

Understanding the 12 requirements of PCI DSS assessments

PCI DSS is structured around 12 core requirements, grouped into six logical objectives. We mentioned that compliance is clear-cut and well-defined; these are the set of rules that must be closely followed.

Build and maintain a secure network

Install and maintain a firewall configuration

Firewalls are the first line of defense in securing your network. They monitor and control inbound and outbound traffic based on security rules, forming a barrier between your secure internal network and potentially insecure external networks. As a result, their proper use is essential in the fight against unauthorized access and the protection of cardholder data.

Do not use vendor-supplied defaults

When you install any system or software, including new firewalls, servers, databases, and routers, it is essential that you don’t leave the default passwords or security settings provided by the vendor. Why? These defaults are well-known and publicly documented; therefore, using them is akin to leaving the door open for attackers.

Protect cardholder data

Protect stored cardholder data

It is often necessary to keep card details on record, but you must take appropriate measures to secure this information. First and foremost, you should only keep what is absolutely necessary, and never store sensitive authentication data (like CVVs) after authorization. For the data you do have to retain, keep it private by encrypting or truncating card numbers.

Encrypt transmission of cardholder data

The above step also applies to data in transit. Sometimes data may have to move over the internet or public networks, but it should always be encrypted.

Maintain a vulnerability management program

Use and regularly update anti-virus software

This may feel like an obvious step, but it is one of the most important. The objective is to prevent malware from compromising systems that store or process cardholder data, and antivirus and anti-malware tools are essential for detecting and removing this malicious software. But they can only work effectively if they are consistently updated, so they can effectively combat the latest threats.

Develop and maintain secure systems and applications

As with your anti-virus software, it is crucial to keep any software or system that touches cardholder data up-to-date and built in a way that minimizes security flaws. This includes writing code that anticipates and blocks common attacks, and using security patches to fix known vulnerabilities.

Just as important is clearly defining PCI scope, since systems that don’t store information can still be in scope if they connect to or affect card data security.

Implement strong access control measures

Restrict access to cardholder data

Just as you should only store card details that you absolutely need, access to cardholder data should similarly be on a need-to-know basis. This means only individuals who require this information to carry out tasks for their role should be able to see it. You can enforce this by implementing strict controls, such as role-based access, which reduce the risk of unauthorized access to sensitive information.

Assign a unique ID to each person

For those who do have access to cardholder data, a unique ID should be assigned to enable monitoring of individual use. This helps ensure that any suspicious activity is flagged before it leads to consequences like a data leak.

Restrict physical access to cardholder data

We’re so used to everything being digital these days, but physical security remains just as important as ever. Access to your data centers or server rooms should be controlled and monitored via solutions like badge systems or cameras.

Regularly monitor and test networks

Track and monitor all access

This step involves noting down everything related to access to network resources and cardholder data. Maintain audit logs of user activity so you can spot suspicious activity and prevent potential data breaches. This level of monitoring may seem overly intensive, but it is key to identifying and responding to security incidents promptly.

Regularly test security systems

Vulnerabilities arise when systems are neglected, so don’t just leave them to their own devices. Perform vulnerability scans, penetration testing, and security assessments, as well as testing firewalls and intrusion detection systems. Doing this regularly ensures everything is working as intended and helps you discover any potential weak spots.

Maintain an information security policy

Maintain a policy that addresses information security

Documenting your security policies and procedures is crucial for PCI compliance. Create clear governance and outline roles and responsibilities throughout your company. This provides teams with an organized framework to work within. Merchants should also formally identify any service providers that handle or support cardholder data, guaranteeing accountability and shared responsibility for security maintenance.

As is evident here, the PCI DSS requirements are clearly written, so they should be easy to follow. However, many organizations struggle with scoping; they’re not certain which systems and people each rule actually applies to. This is particularly true for service providers, who often don’t think they’re part of the PCI scope, but actually are.

The PCI compliance process

You can achieve PCI DSS compliance by completing the following 3 steps:

Assessment

As briefly noted earlier, DSS compliance can be assessed with either an SAQ or a full ROC. Even if your organization qualifies for self-assessment, many opt to engage a Qualified Security Assessor (QSA) to guide the process and support with scoping or other complex factors. It is the best way to ensure nothing slips through the cracks and you can be confident in your compliance.

We are a PCI Qualified Security Assessor

AMR Cybersecurity – Part of Infinum has been approved by the PCI Security Standards Council to assess and validate compliance with the global PCI DSS standard, helping our clients safeguard user payment card data from theft and fraud.

Some SAQs, such as SAQ A, only take a matter of days, whereas more complex ones take weeks. On the other hand, a full ROC often takes 20 to 30 days or more, largely due to third-party dependencies.

So, regardless of whether you are conducting an SAQ or a ROC, what gets assessed? Typically, you will focus on identifying cardholder data, taking an inventory of your IT assets and business processes for payment card processing, and analyzing them for vulnerabilities.

Preparation is largely a documentation exercise. Clearly identify every system and process involved in storing, processing, or transmitting cardholder data—including payment systems and anything connected to them. Any connected system can become an entry point, and a single weakness may be enough to expose cardholder data. Securing the full environment is essential.

Finally, conduct a vulnerability scan and penetration testing to pinpoint any potential security weaknesses.

Remediation

It is to be expected that you will uncover some vulnerabilities during the assessment process. After all, this is what you’re searching for. In this step, you need to address these.

The time and resources taken to complete this stage are very business-dependent, varying based on your organization size and number of vulnerabilities. It cannot be skipped, however, as there is no partial compliance.
To make things easier, first prioritize the potential issues you have found based on their risk level. The more significant the threat they pose to cardholder data, the sooner they should be addressed. Only once these high-risk cases have been solved should you move forward with less critical ones.

Your method of remediation will depend entirely on the vulnerability, from updating firewalls to redesigning processing to implementing additional access controls. Whatever solution you deploy, remember it is most probably not a one-off solution. Each security aspect needs to be continuously monitored for new vulnerabilities. This is the only way to ensure ongoing compliance.

Validation

You have identified and remediated any potential risks; now it is time to prove it. 

It is necessary to be able to confirm that the assessment findings have been rectified and that all PCI DSS requirements have been met in order to demonstrate compliance. The evidence required includes:

A completed SAQ or ROC
Attestation of Compliance (AOC)
Supporting documentation (scan results, policies, test evidence, etc.)

As part of this stage, you must submit these documents to the relevant bodies, usually your acquiring bank or payment processor. They will then decide your result.

Crucially, validation always has a binary outcome: your organization is either deemed compliant, or it is not. There is no in between — no concept of partial compliance. If requirements are not fully met, remediation must continue until validation is successfully completed. Usually, the bank allows a remediation period after which reassessment is required. 

Lastly, this stage is not a one-time exercise. Environments and threats change over time, and, therefore, you must be able to repeatedly prove you’re maintaining compliance.

Choosing the right SAQ to stay PCI compliant

PCI DSS defines multiple SAQ types, each with its own strict eligibility criteria with no flexibility. You must select the correct SAQ in order to stay compliant, but how can you know which is right for your business?

There are different types of SAQs, each designed for a specific payment environment and risk profile, based on how cardholder data is stored, processed, or transmitted. They also vary significantly in:

Number of requirements
Assessment time
Evidence required

Let us explore the most common SAQs:

SAQ A

For merchants who have entirely delegated credit card processing to an outside payment processor. These merchants don’t directly manage payment data.

SAQ A-EP

Also for companies that have outsourced their cardholder data processing. Businesses in this group may operate websites that impact the security of electronic cardholder data, but they do not actually store cardholder information themselves. Regardless, demonstrating the website’s security and ensuring that systems do not inadvertently expose credit data is still a requirement.

SAQ B

Aimed at brick-and-mortar organizations that use dial-in point-of-sale or card imprint machines and do not store customer data. This type is not relevant for most e-commerce companies.

SAQ B-IP

Relates to companies that use point-of-sale or imprint devices that communicate via an IP connection, but do not store customer data on their systems.

SAQ C

Covers organizations that accept payments via payment apps connected to the internet, but do not store cardholder information.

SAQ C-VT

Assesses the security of virtual terminals used to accept payments, and therefore is also not usually relevant for e-commerce merchants.

SAQ P2PE

Relates to companies that use devices secured by point-to-point encryption, and again do not store any data after accepting transactions.

SAQ D for merchants

This is the typical route for e-commerce businesses that handle their own payment systems. These companies are responsible for storing and processing cardholder information, and must provide detailed evidence of how that data is protected.

SAQ D for service providers

Service providers subject to SAQ D requirements need to fill out a separate self-assessment questionnaire. This encompasses hosting services, payment gateways, and managed payment security service providers.

Benefits of becoming PCI DSS compliant

There are several clear benefits to meeting PCI standards:

Reducing risk of card data breaches and fraud

PCI DSS compliance is essential for safeguarding cardholder data and minimizing the chances of payment card breaches and fraud. When you adopt these standardized security measures, you substantially decrease your vulnerability to cyberattacks that could expose sensitive information.

Avoiding fines and penalties

Compliance helps shield you from potentially expensive repercussions. These can include fines, penalties, higher transaction fees, or limitations on payment processing capabilities. In extreme situations, failing to comply might mean losing your ability to accept card payments entirely.

Improving reputation and trust

Beyond simply mitigating risk, PCI DSS compliance demonstrates a commitment to data security, which strengthens your company’s reputation and fosters trust among consumers. It creates confidence among customers, partners, and those involved in payment processing.

Creates a competitive advantage

For service providers in particular, PCI compliance often puts you ahead of the competition. Many merchants require proof of compliance before engaging a vendor, making it a prerequisite for doing business. In contrast, failing to meet PCI DSS requirements can lead to reputational damage and long-term business disruption.

Become PCI compliant with Europe’s leading PCI QSA company

Infinum is excited to welcome AMR Cybersecurity into our team, meaning we can now help organizations quickly achieve PCI compliance in a cost-effective way.

From scoping and gap assessments to SAQ and AoC, and full ROC assessments, we provide tailored guidance to help businesses align with the latest payment security standards.

With years of experience securing payment environments and approval from the PCI Security Standards Council, Infinum and AMR Cybersecurity simplify complexity, validate your security controls, and help you achieve compliance quickly. Our team provides the clarity and expertise you need with hands-on help to protect your cardholder data.

Talk to our experts

Make security proactive, not reactive

Don’t risk getting compromised.

The information above will be stored only for
business purposes. Check our Privacy Policy for
more info.