PCI DSS.

What is PCI DSS?

PCI DSS stands for Payment Card Industry Data Security Standard. The PCI Security Standards Council says it was developed to encourage and enhance payment card account data security and to facilitate the broad adoption of consistent data security measures globally.

The Council says PCI DSS provides a baseline of technical and operational requirements designed to protect payment account data.

Who issues PCI DSS?

The PCI Security Standards Council develops and maintains the standard. The Council describes itself as a global forum for the ongoing development, enhancement, storage, dissemination and implementation of security standards for account data protection. It says it was established in 2006 by five payment brands, which share equally in ownership, governance and execution of its work. Its stated mission is to enhance global payment account data security by developing standards and supporting services that drive education, awareness and effective implementation.

PCI DSS is one of several standards the Council manages. Others named on its site include standards for point-to-point encryption, secure software, PIN security, card production and provisioning, and 3DS authentication.

Who does PCI DSS apply to?

The Council lists the intended audience as entities that store, process or transmit cardholder data or sensitive authentication data, or that could affect the security of the cardholder data environment. It adds that this includes all entities involved in payment card processing, including merchants, processors, acquirers, issuers and service providers.

What does PCI DSS broadly ask for?

At the broadest level, the Council says PCI DSS sets technical and operational requirements to protect payment account data. The full list of requirements is in the standard document itself. The Council’s document library page lists PCI DSS v4.0.1, together with a summary of changes from v4.0 to v4.0.1. This page does not restate the individual requirements. The standard document is the place to read them.

Is PCI DSS a law?

The Council says it develops and maintains standards but does not monitor their implementation. It says that whether an entity is required to comply with, or to validate compliance to, a Council standard is at the discretion of organizations that manage compliance programs, such as a payment brand, an acquirer or another entity. Who must do what therefore depends on those programs, not on this page.

Is PCI DSS the same as the PCI Security Standards Council?

No. PCI DSS is a standard. The PCI Security Standards Council is the organization that develops and maintains it, along with other standards.

Does this page show that an organization is covered or compliant?

No. This page is a plain summary of what the Council’s own pages say. It is not legal or compliance advice. The Council’s pages linked below are the place to check.

How does PCI DSS relate to nearby terms?

Related glossary terms include third-party risk, data breach and cloud security.