Skip to content
Documentation

PCI DSS

What it is

The Payment Card Industry Data Security Standard — a contractual standard from the PCI Security Standards Council (founded by the major card brands) for protecting cardholder data. Current version: PCI DSS v4.0.1. It’s enforced by the card brands and acquiring banks, not by a government.

Who it applies to

Any organization that stores, processes, or transmits the Primary Account Number (PAN). Obligations scale by merchant/service-provider level (transaction volume), from a self-assessment questionnaire (SAQ) up to an on-site audit by a Qualified Security Assessor (QSA) with an Attestation of Compliance (AOC).

Disclaimer. Not legal/compliance advice. Verified 2026-05-29.

The best PCI strategy: don’t touch the PAN

The cheapest way to “be PCI compliant” is to minimize scope so card data never enters your systems:

  • Use a tokenizing payment gateway (e.g., Stripe, Braintree, Adyen) with hosted fields / hosted checkout, so the PAN goes browser-to-gateway and you only ever store a token.
  • This can drop you to the smallest SAQ A scope. Every system that touches PAN is in scope and dramatically increases cost and audit burden.

This is exactly why the platform’s procurement guidance flags payment processing as the one unavoidable closed dependency — let the gateway carry the PCI burden.

The 12 requirements (grouped)

Build & maintain a secure network; protect stored account data (encryption, no storing sensitive auth data); maintain a vulnerability-management program; implement strong access control (need-to-know, unique IDs, MFA); regularly monitor & test networks (logging, scanning, pen-testing); and maintain an information-security policy. v4.0 also emphasizes customized implementation and made a batch of future-dated requirements mandatory as of March 31, 2025.

Sources (verified 2026-05-29)

ClaimSource
PCI DSS v4.0.1; 12 requirements; SAQ/QSA modelPCI Security Standards Council
v4.0 future-dated requirements mandatory 2025-03-31PCI SSC Document Library