PCI DSS Basics
Just been told you need
to comply. Start here.
The five questions we are asked most often, answered in full. What the Standard is, who it applies to, how an engagement runs, what it costs, and who enforces it.
Question one
What is PCI DSS?
A global standard for protecting cardholder data, set by the card brands and passed to you through your payment contracts. What follows covers the requirements, the current version, levels, reporting and how often you are assessed.
The standard and requirements
The Payment Card Industry Data Security Standard (PCI DSS) is a global security standard designed to protect cardholder data and reduce the risk of payment fraud. It outlines a comprehensive set of technical and operational requirements that organisations must follow when storing, processing, or transmitting cardholder information.
These requirements cover areas such as network security, access control, vulnerability management, and ongoing monitoring to ensure a strong and resilient security posture. The 12 ‘high level’ requirements are listed below:
Build and maintain a secure network and systems
- Install and maintain network security controls
- Apply secure configurations to all system components
Protect account data
- Protect stored account data
- Protect cardholder data with strong cryptography during transmission over open, public networks
Maintain a vulnerability management programme
- Protect all systems and networks from malicious software
- Develop and maintain secure systems and software
Implement strong access control measures
- Restrict access to system components and cardholder data by business need to know
- Identify users and authenticate access to system components
- Restrict physical access to cardholder data
Regularly monitor and test networks
- Log and monitor all access to system components and cardholder data
- Test security systems and networks regularly
Maintain an information security policy
- Support information security with organisational policies and programmes
Sub-requirements sit below these, meaning the total number of controls in PCI DSS amount to over 300. However, it is important to note that depending on your compliance environment and reporting requirements, not all of these will apply to every assessment.
The current version
The latest version of the standard, PCI DSS v4.0.1, introduces enhanced security practices that align with today’s evolving threat landscape. It emphasises continuous security, flexibility in implementation, and stronger authentication and encryption measures. Organisations transitioning to v4.0.1 must adapt to new requirements and maintain compliance as part of their ongoing commitment to protecting sensitive payment data.
Check out more info in our detailed PCI DSS v4 Content Hub.
Levels
PCI DSS compliance levels categorise businesses based on their annual volume of payment card transactions. Higher levels apply to organisations that process large numbers of transactions and therefore face more stringent oversight and validation requirements. The four merchant levels, along with separate tiers for service providers, help ensure that security expectations scale appropriately with risk and operational complexity.
Reporting (ROC, SAQ, AOC)
To demonstrate compliance, organisations must complete specific reporting documents depending on their PCI level and business type.
Report on Compliance (ROC)
A detailed assessment performed by a Qualified Security Assessor (QSA) for larger or high-risk entities.
Self-Assessment Questionnaire (SAQ)
Smaller businesses may complete an SAQ, which evaluates their adherence to PCI requirements.
Attestation of Compliance (AOC)
Accompanies both the ROC and SAQ, serving as official confirmation that the organisation meets PCI DSS standards.
Assessment timing requirements, assessed every 12 months
PCI DSS requires organisations to undergo a formal assessment every 12 months to validate ongoing compliance. This annual review ensures that security controls are functioning effectively and that the organisation continues to meet the evolving requirements of the standard. Maintaining continuous compliance, not just annual validation, is essential for reducing risk and protecting cardholder information year-round.
QUESTION TWO
Who has to be PCI
DSS compliant?
MERCHANTS
Any business that accepts payment cards
Any business that accepts payment cards, whether online, in-store, or through mobile channels, is considered a merchant and must comply with PCI DSS. Compliance helps ensure that sensitive card data is protected throughout every step of the transaction process. Regardless of size or industry, all merchants are responsible for maintaining the security controls required by the standard.
SERVICE PROVIDERS
You handle cardholder data for others
Service providers that store, process, or transmit cardholder data on behalf of other organisations are also required to meet PCI DSS requirements. This includes entities such as payment gateways, hosting providers, managed security services, and cloud platforms. Because these organisations often handle large volumes of sensitive data, their compliance is critical to maintaining security across the payment ecosystem.
ISSUERS
Banks and financial institutions issuing cards
Card issuers, banks and financial institutions that issue credit and debit cards to consumers, must also comply with PCI DSS. As they manage sensitive authentication and payment information, issuers play a key role in securing cardholder data. Their adherence to the standard helps maintain trust and safety across global payment networks.
PARTICULAR PRODUCT AND SERVICE LINES
Sometimes only part of an organisation
In some cases, only certain product or service lines within an organisation may be required to meet PCI DSS, depending on how they interact with cardholder data. Businesses that offer specific payment-related tools, platforms, or features must ensure those components meet the necessary security requirements. This targeted compliance approach ensures that any environment touching cardholder data maintains strong protections, even within complex or diversified organisations.
Question Three
How does a Confide-led PCI DSS engagement work?
- Phase 1: Gap analysis
Initially, we review your current security posture, identify gaps against PCI DSS requirements, and provide clear guidance on how to effectively achieve full compliance.
- Phase 2: Remediation support
We then work with you as you address identified gaps, offering expert support to ensure remediation activities meet PCI DSS standards.
- Phase 3: PCI DSS assessment
Finally, we perform the formal assessment and certification process, validating that your organisation meets all applicable PCI DSS requirements.
- PCI managed assurance
Following a successful first assessment, we provide ongoing assurance and oversight to help you maintain sustainable, long-term PCI DSS compliance as your environment evolves.
- Bespoke engagements
In addition to this, we also design tailored consulting, assessment and product engagements to meet your organisation’s specific needs and objectives.
Question four
How much does a PCI
DSS assessment cost?
When it comes to a PCI DSS assessment, there’s one phrase you’ll hear more than once: “It depends.”
The cost is influenced by several factors, including your compliance scope, reporting obligations, payment channel design, and the overall maturity of your security practices.
What we can promise is this: we focus on delivering efficient, targeted assessments that genuinely add value. As consultants first and foremost, we actively look for ways to help you reduce risk and minimise scope, even when it means a smaller assessment for us. Our goal is to ensure you achieve compliance in the most effective and sustainable way possible.
Question Five
Who enforces PCI
DSS compliance?
PCI DSS compliance is primarily enforced by acquiring banks and the major card schemes, which require organisations to meet the standard as part of their contractual obligations for accepting card payments. These entities may impose penalties, increase fees, or restrict payment capabilities if compliance is not maintained.
In addition, many customers, especially enterprise clients, also request evidence of PCI compliance from their suppliers, partners and service providers as part of their due-diligence and ongoing vendor-risk processes, making adherence essential for both contractual and commercial reasons.
ACQUIRERS
SCHEMES
CUSTOMERS
OTHER STAKEHOLDERS
Work out where you
stand, in one call.
Tell us how you take payments and what your acquirer has asked for. We will tell you which validation path applies and what it involves.