What is PCI DSS compliance?

PCI DSS compliance means following the Payment Card Industry Data Security Standard (PCI DSS) requirements designed to protect payment card and account data. The standard applies to organizations that store, process, or transmit cardholder data, as well as organizations that can affect the security of the cardholder-data environment.

PCI DSS compliance involves security practices such as:

• Protecting stored payment data and limiting unnecessary data retention.
• Encrypting payment data when transmitted over public networks.
• Using strong access controls to restrict sensitive information.
• Monitoring and testing security systems regularly.
• Maintaining secure systems and applications and addressing vulnerabilities.
• Maintaining information-security policies and procedures.

For example, a B2B eCommerce business accepting card payments needs appropriate controls to protect customers’ payment information throughout the payment process.

PCI DSS is a security standard rather than a single certificate issued by the PCI Security Standards Council. The specific compliance-validation requirements can depend on the applicable payment brands, acquirers, and the organization’s payment environment.