If you accept, process or store payment cards, the Payment Card Industry Data Security Standard applies to you. It is enforced through your contract with the bank that processes your payments.
- Type
- Industry standard, enforced by contract
- Current version
- PCI DSS v4.0.1 (published 2024-06-11)
- Standard setter
- PCI Security Standards Council
- Enforced by
- Card brands, through acquirers (merchant banks)
- Applies to
- Anyone who stores, processes or transmits card data, or can affect its security
- Validation
- Yearly, plus quarterly external scans
What it is
PCI DSS is a set of twelve groups of technical and operational requirements that protect cardholder data and sensitive authentication data: network security, secure configuration, data protection, encryption, malware defence, secure software, access control, authentication, physical security, logging, testing, and security policy.
Why it exists
To reduce card fraud and data breaches across the payment ecosystem. Before 2004 each card brand ran its own program; PCI DSS unified them so a merchant or service provider meets one standard recognized by all brands.
Who it applies to
Merchants, service providers, processors, acquirers and issuers. Validation depends on your level, set by the card brands. For Visa, merchants processing more than six million transactions a year need a Report on Compliance by a Qualified Security Assessor; smaller merchants usually complete a Self-Assessment Questionnaire (SAQ). Service providers above 300,000 transactions need a QSA assessment.
Breached merchants can be moved up a level.
Authority and enforcement
The PCI Security Standards Council, founded by American Express, Discover, JCB, Mastercard and Visa (UnionPay joined later), writes the standard and qualifies assessors. It does not enforce: the card brands do, through acquirers, who must ensure their merchants and service providers validate compliance at least every twelve months.
- 2004
PCI DSS 1.0 unifies the card brands’ separate security programs.
- 2006
The PCI Security Standards Council is founded.
- 2008–2016
Versions 1.2, 2.0, 3.0, 3.1 and 3.2 follow changes in technology and threats.
- 2018-05
Version 3.2.1.
- 2022-03-31
Version 4.0 is published: customized approach, stronger authentication, targeted risk analysis.
- 2024-03-31
Version 3.2.1 is retired.
- 2024-06-11
Version 4.0.1, a limited revision with clarifications and no new requirements.
- 2024-12-31
Version 4.0 is retired; 4.0.1 is the only active version.
- 2025-03-31
Future-dated requirements become mandatory, including script control on payment pages (6.4.3, 11.6.1) and MFA for all access into the cardholder data environment.
Systems and tools
- Network segmentation to shrink the cardholder data environment
- Encryption and key management for stored and transmitted card data
- Multi-factor authentication and automated log review
- Inventory and change detection for scripts on payment pages
Processes
- Quarterly external scans by an Approved Scanning Vendor
- Penetration and segmentation testing
- Patch and secure-development practices
- Incident response plan and annual scope confirmation
Governance
- Targeted risk analyses
- Service-provider management and responsibility matrices
- Security awareness training
- Policies reviewed every year
If you do not comply
- Non-compliance assessments charged by card brands to your acquirer and passed on to you
- Liability for fraud losses and forensic investigation costs after a breach
- Higher processing fees or a higher validation level
- Termination of your merchant account and loss of the ability to accept cards
- Removal from brand lists of compliant service providers
Announced and upcoming changes
- 2026-06 to 07The Council held a request for comments on v4.0.1 to shape the next revision, including emerging technology and AI.
- No dateNo new version number or publication date has been announced.
Status checked 2026-10-03. Dates can move; confirm with the official sources below.
- PCI Security Standards Council ↗
- PCI document library ↗
- Just published: PCI DSS v4.0.1 ↗
- Role of the PCI SSC (PDF) ↗
- Visa security compliance programs ↗
Related insights
Securing AI use: the Cyber Centre’s 10 AI security measures
The Canadian Centre for Cyber Security's new primer sets out 10 AI security measures in three pillars. What each one asks for, and how…
Read the insight →Post-quantum cryptography: why your first step is a cryptographic inventory
NIST's post-quantum standards are final and Canada has a federal migration roadmap to 2035. Why the first step is a cryptographic inventory, and how…
Read the insight →AI in the payment environment: what the PCI SSC’s new AI guidance means for your scope
The PCI SSC published Security Considerations for AI Systems on 2026-09-15. AI is scoped like any other technology. Where chatbots, agents and shadow AI…
Read the insight →