The global standard for protecting cardholder data. 12 requirements covering network security, encryption, access control and governance — mandatory for any organisation that handles card payments.
The Payment Card Industry Data Security Standard (PCI DSS) is a global security standard designed to protect cardholder data. Developed by the PCI Security Standards Council — founded by Visa, Mastercard, American Express, Discover and JCB — it applies to any organisation that stores, processes or transmits payment card data.
PCI DSS v4.0, released in March 2022 with full enforcement from 31 March 2025, represents the most significant update in over a decade. It introduces a customised approach to validation, stronger authentication requirements, and expanded encryption obligations.
Any organisation that accepts, transmits or stores cardholder data — regardless of size or transaction volume. This includes retailers, e-commerce platforms, payment processors, service providers and any third party with access to cardholder data environments. Compliance requirements scale with transaction volume across four merchant levels.
Install and maintain network security controls. Apply secure configurations to all system components.
Protect stored account data with encryption and key management. Protect cardholder data with strong cryptography during transmission over open networks.
Protect all systems and networks from malicious software. Develop and maintain secure systems and software.
Restrict access to cardholder data by business need-to-know. Identify users and authenticate access to system components.
Restrict physical access to cardholder data. Log and monitor all access to network resources and cardholder data.
Test security of systems and networks regularly. Support information security with organisational policies and programmes.
Version 4.0 introduces a customised approach as an alternative to the traditional defined approach, allowing organisations to meet security objectives through flexible controls. Key changes include mandatory multi-factor authentication for all access to the cardholder data environment, expanded encryption requirements, targeted risk analyses to determine control frequencies, and enhanced requirements for service providers around scope documentation and incident response.
We help organisations scope their cardholder data environment, conduct PCI DSS gap analyses, develop remediation plans, build compliant policies and procedures, and prepare for QSA assessments. Our approach focuses on reducing scope where possible and implementing proportionate controls that satisfy compliance without unnecessary operational burden.
Discuss PCI DSS ComplianceBook a free 30-minute call with Doug. No obligation — just an honest conversation about your compliance posture and what it would take to close the gaps.
Book a Discovery Call