PCI DSS (payment card data security standard)
Security requirements for any environment that stores, processes or transmits payment card data; colocation and hosting providers are in scope for physical security and as service providers when they manage in-scope systems.
- 6requirementsin our own words
- 2editions PCI DSS v4.0.1
- 30places where it is a duty of 30 assessed
- 18 Oct 2026last checkedat the sources below
Where it applies
It is a duty in 30 of 30 places. The outcome holds under the conditions shown and says nothing about any one site.
| Where | Outcome | Basis | Conditions | Authority and route |
|---|---|---|---|---|
| All 30 places | Applies | Required by contract or customer In force | Entity: merchant or service provider handling cardholder data Payment brands and acquirers require validation from merchants and service providers that handle card data; no statute. | Not stated |
What it asks for
6 requirements, each in our own words with the evidence an assessor would expect and who on a site usually owns it. Read the clause itself on the scheme owner's page.
| Requirement | Evidence expected | Owner | When |
|---|---|---|---|
| Define the cardholder data environment and what a hosting provider's systems or facilities touch. | Scope diagram and responsibility matrix Drawing, checked by document review | Security lead | Every year Governance, a system or service |
| Segment and filter networks that carry card data. | Network diagrams and rule reviews Record, checked by document review | IT operations | Continuous Technical limit, a system or service |
| Restrict and log physical access to systems that hold card data. | Access logs and visitor records Log, checked by document review | Security lead | Continuous Technical limit, one site |
| Scan and patch systems regularly. | Scan reports Test report, checked by document review | IT operations | Continuous Technical limit, a system or service |
| Restrict access to need and use strong authentication. | Access reviews Log, checked by document review | Security lead | Continuous Technical limit, a system or service |
| Validate compliance as your payment partners require (assessor report or self-assessment) and keep it current. | Validation document and attestation Record, checked by document review | Compliance manager | Every year Contractual, the organisation |
Editions
Which text is in force, from when, and which one it replaced.
| Edition | Status | Published | In effect | Replaces |
|---|---|---|---|---|
| PCI DSS v4.0.1 | Current Date not shown on the page read. | Not stated | Not stated | PCI DSS v4.0 |
| PCI DSS v4.0 | Superseded | Not stated | Not stated | None named |
About the programme
- Scheme owner
- PCI Security Standards Council
- Assessed by
- Several parties
- Scope
- cardholder data environment
- Levels
- merchant and service-provider levels set by payment brands
- Validity
- Annual validation is set by payment brands and acquirers, not by PCI SSC.
- Accreditation route
- PCI SSC qualifies assessors (QSA) and scanning vendors
- Who asks for it
- Financial-sector clients, Enterprise and colocation customers
- Where it is used
- global
Sources
Official bodies behind this page, each with the date we last read it.
No official body publishes a page for this scheme. The scheme owner's own page, linked under About the programme, is where the clauses are published.
Not legal advice. Confirm each duty against the text itself.