Twelve core requirements, six control objectives, and a single shared contract bind every merchant, processor, and gateway that touches a card number. Swipe a card at a coffee shop, tap to check out online, or hand over plastic at the gas pump, and a chain of security rules quietly fires into action behind the scenes, governing encryption, access control, and network monitoring.
This guide covers what the standard actually requires, how it differs from the broader PCIS umbrella, who it applies to, and the practical steps for determining your compliance path.
The Origin and Purpose of PCIS Standards
Back in the early 2000s, each card brand ran its own security program with its own rules, and merchants juggled overlapping audits. That changed on September 7, 2006, when Visa, Mastercard, American Express, Discover, and JCB jointly founded the PCI Security Standards Council (PCI SSC), a single body to write and govern payment security requirements. The Council publishes the core standards, trains assessors, and approves vendors that perform vulnerability scans, but it does not enforce compliance directly.
Enforcement happens one layer removed. When your business opens a merchant account, the acquiring bank that processes your transactions inserts a contractual clause requiring you to follow PCI standards. Fail the requirement and the bank, not the Council, issues the fine, raises your transaction fees, or terminates your ability to accept cards.
That contract-based structure is why PCIS feels like a law without technically being one, and it is also why smaller merchants can end up confused about whether the rules apply to them.
Who the Framework Actually Governs
Any entity that stores, processes, or transmits cardholder data or sensitive authentication data falls inside the framework, including merchants of every size, payment gateways, hosting providers, software vendors, and any third party that touches the payment flow. The data itself is narrow: it covers the primary account number (PAN), cardholder name, expiration date, service code, plus the sensitive authentication data such as the full magnetic stripe, CVV/CVC, and PIN or PIN block.
Touch any of those elements in any system you control, and PCI compliance requirements begin to apply.
How PCIS Differs From PCI DSS, PA-DSS, and PTS
Most confusion about what PCI compliance means comes from treating PCIS and PCI DSS as the same thing. They are not. PCIS is the umbrella; PCI DSS (Payment Card Industry Data Security Standard) is the single most important document under it. PA-DSS and PTS are two sibling standards that govern specific pieces of the payment ecosystem.
| Standard | Scope | Who It Applies To |
|---|---|---|
| PCIS (umbrella) | The full family of PCI Security Standards Council documents and programs | Used informally to refer to the whole framework |
| PCI DSS | Network security, data protection, access control, monitoring, and policy for cardholder data | Merchants and service providers that store, process, or transmit cardholder data |
| PA-DSS | Security requirements for payment application software sold to merchants | Software vendors building POS, e-commerce, or payment modules |
| PTS (PIN Transaction Security) | Hardware security for PIN entry devices and hardware security modules | Device manufacturers building PIN pads and HSMs |
The PCI Security Standards Council oversees all three, but each standard has its own assessment method, lifecycle, and retirement schedule. Understanding which standard applies prevents you from over-investing in irrelevant controls. A small e-commerce store using Stripe or PayPal checkout, for example, has zero PA-DSS obligations even though it sits squarely inside PCI DSS scope.
The Six Control Objectives and Twelve Requirements That Define PCI DSS
Twelve principal requirements, grouped under six control objectives, form the entire structure of the PCI Data Security Standard. Version 4.0, published in March 2022, is the current major iteration, with future-dated requirements taking full effect in 2025. The structure has stayed stable across versions because the underlying goals of protecting stored cardholder data and maintaining a secure payment environment have not changed.
- Build a secure network: Install and maintain firewall and router configurations, and replace vendor-supplied passwords on every device.
- Protect cardholder data: Encrypt the transmission of cardholder data across open, public networks using strong cryptography such as TLS 1.2 or higher, and render stored account data unreadable through tokenization, truncation, or strong encryption.
- Run a vulnerability program: Protect every system against malware with regularly updated antivirus software, and develop and maintain secure systems and applications through secure coding practices.
- Enforce access control: Restrict access to cardholder data by business need-to-know, assign a unique ID to every person with computer access, and restrict physical access to cardholder data.
- Monitor and test networks: Track and monitor all access to network resources and cardholder data through audit trails, and regularly test security systems and processes with quarterly vulnerability scans and annual penetration tests.
- Maintain a security policy: Maintain a policy that addresses information security for all personnel, including employees, contractors, and third-party partners.
Each requirement expands into multiple sub-requirements in the full standard, with testing procedures and guidance for assessors. Most organizations fail their first assessment not on encryption but on something far more mundane: missing documentation, stale asset inventories, or an unpatched critical vulnerability that showed up on a quarterly scan.
Mapping Compliance Levels and Self-Assessment Pathways
Visa and Mastercard assign compliance tiers based on annual transaction volume, not revenue. The four merchant levels and four service-provider levels dictate whether you need a full audit by a Qualified Security Assessor (QSA) or can complete a Self-Assessment Questionnaire (SAQ) instead. Tier matters because the wrong path wastes both time and money.
| Level | Visa Annual Volume (transactions) | Assessment Path |
|---|---|---|
| Level 1 | More than 6 million | On-site QSA-led Report on Compliance (ROC) |
| Level 2 | 1 million to 6 million | SAQ or ROC depending on acquirer preference |
| Level 3 | 20,000 to 1 million e-commerce only | SAQ matched to integration |
| Level 4 | Fewer than 20,000 e-commerce or up to 1 million other channels | SAQ matched to integration |
Choosing the Correct SAQ Type
SAQ selection depends on how you accept cards, not just how many transactions you process. The PCI SSC publishes eight types: A, A-EP, B, B-IP, C, C-VT, D, and P2PE-HW. Type A covers fully outsourced e-commerce where your website never touches card data, such as payment pages hosted entirely by Stripe Elements. Type A-EP applies when your site redirects to a hosted page but still controls the redirect logic.
Type D is the catch-all that covers most custom integrations and is the longest, most demanding questionnaire in the set.
Quarterly external vulnerability scans from an Approved Scanning Vendor (ASV) are mandatory regardless of merchant level, as long as any system in your Cardholder Data Environment (CDE) faces the public internet. Skipping the scan is one of the most common findings during acquirer reviews.
Pick the SAQ by looking at your payment integration first, and your transaction volume second. Volume determines the level; integration determines the questionnaire.
Consequences of Non-Compliance and Real-World Enforcement Risks
Card brands publish monthly non-compliance fines that can range from $5,000 to $100,000 per month for Level 1 merchants, with acquiring banks typically passing those costs straight to the merchant. Smaller merchants face lower headline numbers but rarely escape consequences, because acquirers raise transaction fees, demand forensic investigations billed to the merchant, or simply decline to renew the merchant account at contract renewal.
The damage after a breach is where compliance gaps get truly expensive. Target’s 2013 breach ultimately cost the company more than $200 million in settlements, legal fees, and remediation. The Home Depot breach in 2014 led to a $198 million multistate settlement plus an estimated $200 million in card-reissuance costs absorbed by banks. In both cases, the initial PCI fine was the smallest line item on the bill.
Brand damage, class-action lawsuits, and years of security overhaul dwarf the direct penalties.
Compliance is also ongoing, not a one-time certification. Annual assessments, quarterly ASV scans, and continuous evidence collection, including firewall rule reviews, access recertification, and patch logs, are expected every year. Treat it as a security program, not a checkbox, and the audit becomes a snapshot of work you are already doing.
Next Steps for Determining Whether PCIS Applies to Your Organization
If your business accepts card payments in any form, PCIS applies. The question is which document governs your specific situation and how much of your infrastructure falls inside the Cardholder Data Environment. Start by mapping every system that stores, processes, or transmits cardholder data, including adjacent systems that connect to the CDE, since a single network segment touching the CDE pulls the entire segment into scope.
Building a Scoping Inventory
- List every payment flow: Card-present terminals, e-commerce checkout, mobile readers, phone orders, recurring billing, and any manual card entry.
- Trace data at each step: Where does the PAN live, even briefly?
- Map connected systems: Any server that can reach a CDE system on the network is potentially in scope.
- Document compensating controls: Network segmentation can shrink the CDE, but only if you can prove it with firewall rules and architecture diagrams.
Once you have a defensible scope, compare it against PCI DSS v4.0, the current major version published in March 2022, and note which customized approach options apply to your environment. The customized approach lets you meet a requirement’s intent with a different control than the defined one, provided a QSA validates the design and effectiveness.
For Level 1 merchants and many service providers, engaging a QSA early avoids missteps; for SAQ-eligible merchants, the PCI SSC’s official SAQ documents remain the authoritative source. Avoid relying on secondary summaries, because SAQ eligibility criteria and v4.0 future-dated requirements shift over time.
Quick Decision Checklist
- Your business accepts cards: PCI compliance requirements apply to you regardless of size.
- You process over 6 million transactions annually: You are Level 1; plan for a QSA-led ROC.
- You use a fully hosted payment page: You likely qualify for SAQ A, the shortest questionnaire.
- You stored CVV data after authorization: That is a hard PCI violation. Purge the data immediately and rotate any credentials exposed to it.
- Your environment is complex: Engage a QSA for a scoping assessment. The cost is far lower than a failed audit or breach.
When specialized expertise matters, consult a qualified professional for your specific situation. The same principle applies to compliance: confirm your obligations with a Qualified Security Assessor or your acquiring bank before relying on a generic checklist, since the Payment Application Data Security Standard (PA-DSS) and PCI DSS expectations evolve with each major version.
The Bottom Line
PCIS is the umbrella; PCI DSS is the binding standard under it. Knowing which one governs your business, which compliance level applies to your transaction volume, and which SAQ matches your integration method turns compliance from a vague obligation into a concrete project with measurable checkpoints. Scope accurately, document continuously, and the annual assessment becomes confirmation of work already underway.
FAQ
What is PCI compliance and why does it matter?
Every merchant that stores, processes, or transmits cardholder data is bound by the PCI Data Security Standard, a private rulebook written and enforced by the major card brands. It matters because compliance failures can lead to fines, higher transaction fees, loss of card processing privileges, and significantly greater damage if a breach occurs.
Who is required to be PCI compliant?
Any organization that stores, processes, or transmits cardholder data, including merchants, payment gateways, software vendors, and any third-party service provider that touches the payment flow. Size does not exempt a business from scope.
What are the PCI DSS requirements?
Twelve principal requirements, grouped under six control objectives, cover everything from firewall configuration and data encryption to vulnerability scanning, access restrictions, and incident response planning. Each requirement expands into detailed sub-requirements in the official standard.
How do you become PCI compliant?
Determine your merchant level, scope your Cardholder Data Environment, complete the matching Self-Assessment Questionnaire or hire a QSA for a Report on Compliance, remediate any gaps, run quarterly ASV scans, and submit the attestation of compliance to your acquiring bank.
What is the difference between PCI DSS and PA-DSS?
Any merchant, processor, or service provider that handles cardholder data falls under PCI DSS, while software vendors who build the payment applications themselves fall under PA-DSS. A merchant using third-party software that is already PA-DSS-validated still must comply with PCI DSS for their own environment.
What happens if you are not PCI compliant?
Acquiring banks can levy monthly non-compliance fines, raise transaction fees, require paid forensic investigations, or terminate your merchant account. After a breach, non-compliance also exposes you to lawsuits, regulatory penalties in some industries, and lasting brand damage.
