PCI DSS.

What PCI DSS actually governs

PCI DSS is the security baseline imposed by the major payment card brands on every organisation that stores, processes or transmits cardholder data. It is not a law and not a government regulation. It is a contractual requirement, enforced through the acquiring banks and the card schemes that sit above them. If you handle a primary account number, the standard applies to you, whether you are a global retailer or a small e-commerce shop running a single checkout page.

The standard is organised around a set of control objectives that cover the people, processes and technology touching cardholder data: building and maintaining a secure network, protecting stored account data, encrypting transmission, managing vulnerabilities, restricting access on a need-to-know basis, monitoring and logging, and maintaining a written information security policy. Each objective decomposes into concrete, testable requirements, which is why PCI DSS reads more like an audit checklist than a principles-based framework such as ISO 27001.

Scope is the whole game

The most important practitioner decision is not how to pass the assessment but how to shrink what gets assessed. Everything that stores, processes or transmits cardholder data, plus anything connected to it, falls inside the cardholder data environment (CDE). The larger the CDE, the more systems must meet every requirement and the more painful and expensive the assessment becomes.

This is where tokenisation, network segmentation and outsourcing to compliant payment providers earn their keep. By replacing card numbers with tokens, isolating the CDE behind firewalls, and pushing the actual card capture onto a hosted page or a third-party processor, you remove systems from scope entirely. A well-segmented environment can shrink a sprawling estate down to a handful of components that need full validation.

How validation works in practice

How you demonstrate compliance depends on transaction volume and how you accept payments. Smaller merchants typically complete a Self-Assessment Questionnaire (SAQ), choosing the version that matches their acceptance channel. Larger merchants and service providers undergo a formal assessment by a Qualified Security Assessor (QSA), who produces a Report on Compliance. Network scanning by an Approved Scanning Vendor and quarterly evidence are common obligations across tiers.

The current revision, version 4.0.1, moves beyond a pure checklist. Alongside the prescriptive "defined approach", it introduces a "customised approach" that lets mature organisations meet a control objective with their own designed controls, provided they can document and evidence that the objective is met. It also reframes compliance as a continuous state rather than an annual snapshot, with several requirements explicitly demanding business-as-usual monitoring.

How it sits next to other standards

Teams often confuse PCI DSS with ISO 27001. They overlap but answer different questions. ISO 27001 certifies that you run an information security management system; PCI DSS validates that a specific, prescribed set of controls protects cardholder data. One is a management-system certification you scope yourself; the other is a fixed control set imposed by an external industry body. Running an ISO 27001 ISMS gives you governance scaffolding that makes PCI evidence easier to produce, but it does not substitute for the card-data-specific requirements.