Payment Card Data Security (PCI DSS)

PCI DSS (Payment Card Industry Data Security Standard) is a security standard developed for organisations that process, transmit or store cardholder data. It is not a law but a contractual regime imposed by the card schemes (Visa, Mastercard and others). The level of compliance depends on levels (Level 1-4) set by transaction volume: high-volume organisations undergo an on-site assessment by a qualified QSA and a Report on Compliance (RoC), while lower-volume ones use a Self-Assessment Questionnaire (SAQ). The version currently in force is PCI DSS v4.0.1.

• E-commerce sites and businesses taking online payments
• Retailers using POS and payment terminals
• Payment service providers and payment institutions
• Data centre and cloud providers hosting card data
• Businesses taking card payments through a call centre

Not legally mandatory; it is effectively mandatory because of contracts with the card schemes and banks. Noncompliance can result in a fine, higher transaction fees, or revocation of the right to accept cards. In the event of a data breach, compliance status directly affects the liability assessment.

• Goal 1 — Build and maintain a secure network and systems: network security controls, secure configuration
• Goal 2 — Protect cardholder data: protecting stored data, encryption during transmission over open networks
• Goal 3 — Maintain a vulnerability management programme: protection against malware, secure systems and software development
• Goal 4 — Implement strong access control: restricting access by business need, authentication, physical access control
• Goal 5 — Regularly monitor and test networks: logging and monitoring, regularly testing system and network security
• Goal 6 — Maintain an information security policy and programme
• Scoping: the cardholder data environment (CDE) and segmentation
• The validation route by level: RoC (with a QSA) or SAQ (self-assessment)
• ASV scanning and penetration-testing obligations
• Issuing the Attestation of Compliance (AoC)

1. 1Determining Scope and ProgrammeThe sites and processes to be audited, and the audit duration the scheme requires, are determined.
2. 2Pre-assessmentA gap analysis is optionally carried out; gaps become visible before the main audit.
3. 3On-site AuditRecords review, site observation and worker interviews are carried out against the scheme's checklist.
4. 4Reporting of FindingsFindings are reported according to the scheme's classification. The output of these schemes is an audit report, not a certificate.
5. 5Corrective Action and Follow-upA corrective action plan is submitted for the findings; it is closed with a follow-up audit under the scheme.

The validity period of audit reports is set by the scheme and is mostly between one and two years. The report is used for the period the buying brand accepts.

• Organisation and site details
• Headcount and shift pattern
• Legal permits and licences
• Relevant policies and procedures
• Payroll, time and personnel records
• The cardholder data flow diagram and network topology
• The scope (CDE) definition and evidence of segmentation
• The system inventory and configuration standards
• ASV scan reports and penetration-test reports
• The access-authorisation matrix and authentication records
• Information security policies and the incident-response plan
• The list of third-party service providers and their compliance status

There is no fixed list price; the cost is calculated based on the following variables and provided in writing in the quote.

• The number of sites to be audited and the headcount
• The audit duration the scheme prescribes
• Whether a pre-assessment (gap analysis) is requested
• Whether a follow-up audit is required

Most of these schemes produce audit reports, not documents, and are subject to the scheme owner's (e.g. Sedex, amfori, RBA) own approval system; Accreditation in the classical sense is not found in every scheme. Auditor competence and report validity are determined by the scheme owner's rules.

The scope under which this scheme can be offered varies according to your product and activity; it is confirmed in writing at the quote stage.

• SOC 1Financial Reporting Controls
• SOC 2Service Organization Trust Controls
• TISAXAutomotive Information Security Assessment
• ISO/IEC 27001Information Security Management
• ISO/IEC 27017Cloud Security
• ISO/IEC 27018Personal Data in the Cloud
• ISO/IEC 27701Privacy Information Management
• ISO/IEC 42001Artificial Intelligence Management System