The Ultimate Guide to
Payment Card Industry Data Security Standard (PCI DSS)
What is PCI DSS?
PCI DSS (Payment Card Industry Data Security Standard) is an information security standard designed to help all organizations who handle credit card transactions maintain a secure environment. The standard was developed by the PCI Security Standards Council, an independent body founded by major card brands including Visa, MasterCard, and Discover.
Protecting Cardholder Data
According to the Federal Trade Commission, credit card fraud continues to be one of the fastest forms of identity theft. In 2024, the FTC received over 449,000 reports, an increase of 8% from the 416,000 reports in 2023. To put this in perspective, 62 million Americans reported fraudulent charges on their credit cards or debit cards. These purchases were in excess of $6.2 billion.
Consumers today are aware of the risks when they share their cardholder information with businesses, and they’re wary of transacting with businesses that don’t take information security seriously. By implementing the Payment Card Industry Data Security Standard—a baseline of technical and operational requirements designed to protect cardholders data, you can shield your organization from embarrassing data breaches, loss of sensitive cardholder information, and loss of consumer trust. Becoming compliant with the data security standard established by the Payment Card Industry Security Standards Council is essential today to your company’s long-term success.
PCI DSS Requirements
The latest version of the standard (v 4.0.1), published in June of 2024, contains 12 broad requirements across 6 areas:
PCI Data Security Standards — High-Level Overview
source: PCI Security Standards Council
Build and Maintain a Secure Network and System
Protect Cardholder Data
Maintain a Vulnerability Management Program
Implement Strong Access Control Measures
Regularly Monitor and Test Networks
Maintain an Information Security Policy
What are common control failures?
The most common failures occur when the PCI DSS controls are exploited because they aren’t put in place or they have been poorly implemented. Threat actors take advantage of an organization’s improper storage of sensitive authentication data (SAD) when it should not be stored after authorization, inadequately coded web applications, or a lack of logging and monitoring controls. In addition, poor scoping decisions can commonly result in a breach in cardholder data through a weakness in the network not adhering to the standard.
How does PCI DSS fit into your overall compliance program?
While PCI DSS is more specific to cardholder data protection, the controls needed to safeguard the program are similar to those used by other infosecurity standards and certifications. For example, access control and employee training are common controls that overlap across frameworks. This means that if you already adhere to another information security framework (e.g., ISO 27001, NIST CSF, SOC 2 Type 2), you may already have done a lot of the work needed for PCI DSS compliance.
If you’ve already implemented an information security framework in the Hyperproof platform and you’re looking to meet PCI requirements, the Hyperproof platform will recommend which existing controls you can leverage to fulfill PCI requirements, making it significantly easier and faster to complete the standard. Conversely, the controls you implemented for PCI DSS can be reused to meet the requirements of other information security standards and frameworks.
Note that PCI DSS does not supersede local or regional laws, government regulations, or other legal requirements.
What is the process to become PCI DSS compliant?
There are three main stages to becoming compliant with the standard.
1. Assess
Identify cardholder data and record all information technology assets and business processes for processing the card payments. Analyze the assets and processes for vulnerabilities.
2. Remediate
Fix any vulnerabilities you found in step one and permanently eliminate cardholder data, unless keeping it is absolutely essential.
3. Report
Validation of PCI DSS compliance is determined by payment card network requirements, which may involve Self-Assessment Questionnaires or assessments by third-party Qualified Security Assessors, depending on factors such as annual transaction volumes.
Which PCI DSS compliance validation level is right for me?
There are multiple compliance validation levels for PCI DSS, and the compliance validation level you must adhere to is determined by the individual payment brands you work with. Payment brands and acquirers determine specific compliance validation requirements, which may include self-assessments and network scans by approved scanning vendors.
General Tips and Strategies for Implementing PCI DSS
Below are some general tips for starting your PCI DSS compliance effort. These tips are designed to help you limit risks, limit the scope of your compliance effort, and keep costs contained.
The best step you can take to protect cardholder data is to not store any cardholder data you do not need, and to isolate the data you do need to well-defined and controlled central locations.
Sensitive authentication data includes the full track contents of the magnetic stripe or equivalent data on a chip, card verification codes and values, PINs, and PIN blocks. This data should NEVER be stored after authorization.
If your business uses POS in retail locations, you need to ensure that your POS vendor has sufficient security measures. For instance, ask them whether default settings and passwords have been changed on systems and databases that are part of your POS system. Ask them whether your POS software is storing sensitive authentication data, such as track data or PIN blocks (this is prohibited), and if “yes”, how quickly they can delete this data.
You can limit the scope of a PCI DSS assessment by consolidating data storage in a defined environment and isolating the data through the use of proper network segmentation. For instance, by making sure that the cardholder data is stored on its own network segment, rather than the same network segment your employees use to receive emails and browse the internet, you can put PCI DSS controls on a portion of your network instead of the entire network.
If your organization cannot meet a specific PCI DSS requirement due to legitimate and documented technical or business constraints, compensating controls may be considered as alternative security measures. These controls must meet six specific criteria, including meeting the intent and rigor of the original requirement, providing a similar level of defense, and being above and beyond other PCI DSS requirements. They must be documented using the Compensating Controls Worksheet and validated by assessors annually.
It’s not enough to set up the security controls just to pass a one-time assessment. To effectively secure these systems and payment data, your organization should continuously monitor and enforce the use of controls specified in the PCI Data Security Standard (more on this below).
PCI DSS: Frequently Asked Questions
Hyperproof for PCI DSS Compliance
Hyperproof’s compliance operations software solution helps organizations understand the requirements of PCI Data Security Standard, create tailored controls for their business, streamline and automate the evidence management process and monitor their security controls to ensure ongoing effectiveness. Plus, our PCI DSS framework template will get you up and running quickly.
Hyperproof also partners with professional service firms with proven track records and deep expertise in helping organizations get PCI DSS assessment-ready. Our partners help customers design their information security compliance programs, build them out, and conduct readiness assessments to ensure there are no surprises when the audit occurs. If you need a referral, we’d love to talk.
Ready to see
Hyperproof in action?
