PCI 101?All you need to know about the Payment Card Industry
Payment Card Industry (PCI) is the financial sector that uses all forms of payment electronically.
Updated
On this page
Updated November 2026. This was first published on 24 May 2020. The idea is the same. Any number below is what the original piece said then. It is not a new count.
Key takeaways
- Payment Card Industry (PCI) is the financial sector that uses all forms of payment electronically.
- PCI is the term used to describe companies handling all forms of payments like credit, debit, ATM, and pre-paid cards.
- American Express, Visa, MasterCard, Discover, and Japan Credit Bureau established the PCI Security Standards Council on September 7th, 2006, with the objective of managing and preserving the PCI Data Security Standard (DSS).
What is PCI? #
Payment Card Industry (PCI) is the financial sector that uses all forms of payment electronically.
PCI is the term used to describe companies handling all forms of payments like credit, debit, ATM, and pre-paid cards. American Express, Visa, MasterCard, Discover, and Japan Credit Bureau established the PCI Security Standards Council on September 7th, 2006, with the objective of managing and preserving the PCI Data Security Standard (DSS). The DSS provides payment card processing companies with the obligation to safely transmit and store the customer details before, after, and after a transaction.
Any merchant accepting credit card payments must comply with the PCI DSS. The PCI DSS covers security control specifications, policies, procedures, network architecture, design of applications, and other essential preventive steps. In non-compliance with PCI laws businesses are vulnerable to the adverse consequences of data violations, including fines, penalties, and business losses.
Self-assessment Questionnaires to help companies verify compliance with their PCI DSS. A list of licensed PIN transaction devices and PIN Transaction Security (PTS) specifications for system vendors and manufacturers. Payment Application Data Security Standard (PA-DSS), and a list of approved payment applications to help the creation and production of secure payment applications by software vendors and others. Public resources: Lists of Qualified Security Assessors (QSAs) Payment Application Qualified Security Assessors (PA-QSAs) Approved Scanning Vendors (ASVs) Internal Security Assessor (ISA) education program.
Why did PCI come into existence? #
The PCI-DSS offers the security of data and information on the customer credit card. The norm was established to minimize fraud incidents by increasing the amount of cardholders’ security controls. Qualified Security Assessors (QSA) is assessing safety and adherence to a specific information system using the twelve PCI DSS criteria.
In the largest Fintech markets, such as India, China, and the United States, the online payment adoption rate rose from 16% in 2015 to 60% in 2019. With an increase of almost 100% every two years, it is evident that online transactions are now the preferred mode of payment. On the other hand, the global e-commerce industry continues to grow at 23% per year.
The combination of online shopping and electronic payments has simplified life. But, data violation, phishing attacks and credit card fraud have also increased exponentially. Customers and on-line retailers have been hit by more and more incidents of credit card fraud and charges.
What does PCI mean for IT companies? #
If you use the internet to process any payments, claim or keep any customer payment details on your computer, or even pay by phone, the entire IT network needs to be PCI DSS compliant.
Compliance with PCI DSS includes that you be able to search all internet traffic coming from addresses outside your protected network. Setting up and running a simple firewall is a perfect way to make sure you’ve done this. Poor password security is an easy way to expose your company to security threats and violate PCI DSS compliance, as recently discovered by the UK government. The introduction of a corporate-wide policy on all passwords is a smart way to help ensure compliance. It is necessary to bear in mind that certain details on the credit card can be saved without breaching PCI DSS compliance as long as it is secured, while others cannot. Cardholder data may be stored, including account numbers, the names of the cardholder and the expiry date, if secured to enable repeated transactions and record keeping. It’s critical to ensure your IT infrastructure is able to re-route calls to safe payment platforms in your customer contact centers when your firm takes payment information via phone. It is extremely important that your customers do not send confidential data without encryption if their services are paying for through their web sites. The SSL certificate and security protocols will encode your network. It is important that only those in your company who absolutely need access to data can access them.
To ensure PCI-DSS compliance, ensure that the cloud storage arrangements are exactly demonstrated for your IT workers, cloud service providers, and PCI-DSS assessors.
Software as a service (SaaS)* provides a very low control over the specific cloud configuration of your IT network. PaaS (Platform as a Service) t*hat gives your company some use over the cloud setup Service Infrastructure (IaaS) provides your company with complete control over operating systems, storage, applications, and components such as firewalls that work across your cloud storage.
Compliance with PCI is classified into four rates according to the total amount of business process credit or debit card transactions. The level of classification determines what a company needs to do to be compliant.
Levels of PCI Enforcement #
Level 1: Applies to dealers who process over six million credit or debit card transactions every year in the real world. They will undergo an internal audit once a year, conducted by an accredited PCI auditor. They will have to send an Approved Scanning Vendor (ASV) to the PCI scan once a quarter.
Level 2: Applies every year to merchants who process credit or debit card transactions of between one and six million real worlds. They ’re required to complete an assessment once a year using a Self-Assessment Questionnaire (SAQ). A four-month PCI scan can also be appropriate.
Level 3: This refers to e-commerce transactions between 20 000 and 1 million a year. You have to complete an annual report with the correct SAQ. There is also a need for quarterly PCI scans.
Level 4: applicable to merchants that process fewer than 20,000 transactions per year, or process up to a million transactions in the Real World. Level 4: An annual review with the corresponding SAQ is required and a quarterly PCI scan may be required.
What does PCI mean when it comes to Data Security? #
For the long-term success for all merchants who process card payments, the security advantages associated with PCI compliance are vital. This involves ongoing detection of possible risks and vulnerabilities for the company. Most companies, because the damage is greater than the data itself, never completely recover from data breaches.
The 12 PCI DSS requirements are as follows:.
Set up and retain a cardholder data security firewall configuration 2. Do not use system passwords and other security parameters with vendor-supplied defaults 3. Encrypt cardholder data transmission across public, open networks 5. Using anti-virus tools or programs and upgrade them periodically 6. Develop and maintain stable applications and systems 7. Restrict access by the company to cardholder data 8. Offer every person with a computer access a unique ID. Track and monitor any connection to the cardholder and network resources 11. Check systems and processes for safety regularly 12. Maintain an information security strategy for all employees.
Notable PCI Success & Failures #
In 2016, for the first time, more than half (55.4%) of companies were fully PCI DSS compliant at interim validation’compared with 48.4% in 2015. Full compliance has increased almost five-fold compared to our analysis of 2012 assessments. PCI DSS compliance has increased by 167% since 2012.
Security in the retail industry has significantly worsened over the past year, to the point that over 90% of domains analyzed recently were found to be non-compliant with PCI DSS.
Application security was a particular challenge, with retail second only to the entertainment sector in its poor performance.
When it came to social engineering, often the first stage of an attack or data breach in the form of phishing emails, the sector performed worst out of the 18 appraised.
In 91% of retail domains analyzed, the business failed four or more requirements of the key PCI DSS standard, with requirement six ? dealing with maintaining secure systems and applications ?
Compliance with the Payment Card Industry Data Security Standard (PCI DSS) has fallen for the second year in a row to just 36.7% globally, according to new statistics released by network services provider Verizon in its 2019 Payment security report.
Has PCI achieved, what it set out to achieve? #
Due to the scale and complexity in the payment architectures in use that covers multiple business lines and payment channels, PCI DSS adoption is never done with the switch. It takes months even to get the initial de-scoping ?
Ironically, GDPR is making us think again, even as PCI DSS is simplified by P2PE (Point to Point Encryption) in the face-to-face payment system. The quantity of personal information processed in the store should be taken seriously and if it puts us in a position to take controls on the requirements such as the mandatory malware safety, integrity checking on POS systems and back-office systems, we might not yet be home and dry from a more detailed perspective in the field of security.
Changes to the PCI on the Horizon #
The credit card data protection requirements can alter four different areas. These areas concentrate on frequency authentication, encryption, tracking, and vital controls. The PCI DSS 4.0 version of the Payment Card Industry Security Standards Council (PCI SSC) has increased support for the introduction and modification of new payment initiatives.
The PCI SSC worked with Europay, the Mastercard and the Visa (EMVco) Consortium to improve authentication standards, as well as for payment processes, for both control process access log-ins. The use of the 3DS Core Security Standard in transaction authorization is one element on which the new PCI DSS 4.0 iteration can focus more on detail. The need to keep cardholder data safe on trusted networks is becoming more critical in this industry with cyber threats growing. The use of malicious code that can reside in the network is one of the biggest threats that must be examined. The new PCI DSS 4.0 will include more risk-based strategies. Innovation is growing increasingly as businesses are searching for plugging-in solutions in the PCI Computer Security System in their information systems. In the previous PCI DSS specifications, many of the approved companies have Designated Entities Supplemental Validation (DESV). This means that this PCI DSS version can also have its place through the control frequency test and the addition of checks.
Questions and answers #
What is PCI? #
Payment Card Industry (PCI) is the financial sector that uses all forms of payment electronically. PCI is the term used to describe companies handling all forms of payments like credit, debit, ATM, and pre-paid cards.
Why did PCI come into existence? #
The PCI-DSS offers the security of data and information on the customer credit card. The norm was established to minimize fraud incidents by increasing the amount of cardholders’ security controls.
What does PCI mean for IT companies? #
If you use the internet to process any payments, claim or keep any customer payment details on your computer, or even pay by phone, the entire IT network needs to be PCI DSS compliant.
What does PCI mean when it comes to Data Security? #
For the long-term success for all merchants who process card payments, the security advantages associated with PCI compliance are vital. This involves ongoing detection of possible risks and vulnerabilities for the company.