PCI DSS follows the card data, wherever your systems let it travel.

The PCI Security Standards Council, formed by the major card brands, maintains the standard. It sets twelve groups of requirements, from network controls to logging and testing. Your card data environment, the systems that touch card numbers and anything connected to them, is what the rules apply to.

Spelled out: Payment Card Industry Data Security Standard.

Accepting cards means agreeing, through your acquiring bank or payment partner, to protect card data to this standard. The Council writes the standard, but the card brands and acquirers decide who must validate, how often and in what form. A large merchant or service provider may need a Report on Compliance signed by a Qualified Security Assessor; smaller ones often complete a Self-Assessment Questionnaire. Both end in an Attestation of Compliance. The cheapest control is often design: a hosted payment page or tokenisation can take most systems out of scope altogether.

Acquirer or payment partner contract

The clause that obliges you to comply and says which validation you owe.

Self-Assessment Questionnaire or Report on Compliance

The validation document, chosen by your merchant level and how you take payments.

Requirement 11

The requirements on vulnerability scans, external scans by an Approved Scanning Vendor, and penetration testing, including segmentation checks.

Enterprise vendor reviews

Buyers ask for your Attestation of Compliance, not the full report.

ISO 27001 or SOC 2

Broad security frameworks you choose to pursue. PCI DSS is a contractual card-industry duty limited to the card data environment.

ASV scan

One external scan requirement inside the standard. Passing it is not compliance with PCI DSS as a whole.

• Draw the card data flow end to end and mark every system that stores, processes or transmits card numbers, or connects to one that does.
• Ask your acquirer or payment partner, in writing, which validation document and assessor they require.
• Look for scope reduction first: hosted pages, tokenisation and network segmentation that is tested.
• Schedule the scanning and penetration testing the standard requires, and keep reports with remediation and retest evidence.

• GuideNetwork penetration testingTesting internal and external networks the way an intruder would approach them.
• GuideSecurity testing servicesVulnerability assessment and penetration testing, scoped to what your buyers and auditors ask for.
• GuideSOC 2 for e-commerce platformsMerchant data, payment flows and peak-load availability.

Sources: PCI Security Standards Council, PCI DSS v4.0.1 and its summary of changes; PCI SSC Self-Assessment Questionnaire instructions and guidelines; PCI SSC guidance on penetration testing and on scoping and segmentation.