PCI DSS

What is PCI DSS ?

PCI DSS is a Payment Card Industry Data Security Standard - a set of security requirements for protection of cardholder data.

Six card schemes participate:
Visa, Mastercard, American Express, JCB, Discover and China Union Pay.

Who requires PCI DSS ?

Companies that process, store or transmit payment card data.

Merchants show compliance to their acquirers.

Service Providers (SP) (Banks, Payment Processors) show compliance to card schemes*.

Why get PCI DSS ?

• Requirement of card schemes
• Requirement of acquirers
• Promote your business as payments-secure to customers and partners.

How often ?

You need to renew your PCI DSS compliance annually.

How to get PCI DSS ?

Your path is determined by two questions:

1. Merchant or Service Provider?
2. Number of transactions per year?

You either fill-in a questionnaire yourself or get certified by a QSA company.

PCI Data

Cardholder Data:

• PAN (primary account number)

Sensitive Authorization Data:

• Track or Chip Data
• PIN or PIN block
• CVV2 (security codes)

PCI Levels (SP)

Levels for Service Providers are set by the card schemes, e.g. Visa, Mastercard. Level depends on annual transactions per card scheme.

• Level 1: > 300K (audit by a QSA)
• Level 2: < 300K

PCI Levels (Merchants)

Levels are set by the card schemes, e.g. Visa, Mastercard. Level depends on transactions per year.

• Level 1: > 6M (audit by a QSA)
• Level 2: 1M - 6M
• Level 3: 20K - 1M
• Level 4: < 20K

PCI DSS 4.0

Total 280 requirements.
64 new requirements:

• 13 immediate
• 51 from March 31, 2025

Assessments can be conducted from August 2022.