PCI DSS
The Payment Card Industry Data Security Standard — a set of security requirements for organizations that handle cardholder data, mandated by card networks.
PCI DSS (Payment Card Industry Data Security Standard) is a comprehensive set of security requirements established by the PCI Security Standards Council (founded by Visa, Mastercard, American Express, Discover, and JCB) that applies to any organization that stores, processes, or transmits cardholder data — credit card numbers, expiration dates, CVV codes, or cardholder names.
The standard is organized into six core goals and 12 requirements covering: building and maintaining a secure network, protecting cardholder data, maintaining a vulnerability management program, implementing strong access control, regularly monitoring and testing networks, and maintaining an information security policy.
Compliance levels are tiered by transaction volume: Level 1 merchants process over 6 million Visa or Mastercard transactions annually and must undergo annual QSA (Qualified Security Assessor) audits and quarterly network scans. Level 2 merchants (1–6 million transactions) complete an annual Self-Assessment Questionnaire (SAQ). Levels 3 and 4 have progressively lighter requirements.
The most impactful scope-reduction strategy is tokenization: replacing actual card data with tokens that cannot be reverse-engineered. Companies that never handle raw card data (relying instead on payment gateways like Stripe or Braintree that handle the sensitive data) can qualify for simplified SAQ-A compliance with minimal requirements.
Non-compliance with PCI DSS doesn't carry direct regulatory fines, but card networks impose penalties through acquiring banks: $5,000–$100,000/month for Level 1 merchants and potential loss of card acceptance privileges. Following a breach of cardholder data, forensic investigation costs, mandatory upgrades, fines from card networks, and notification and monitoring costs for affected cardholders can total millions.
FAQs
Does using Stripe or Braintree make a business PCI compliant?
Using a hosted payment gateway like Stripe or Braintree dramatically reduces PCI scope because raw card data is handled by the gateway (which is PCI Level 1 compliant), not the merchant. Merchants using Stripe's embedded checkout or Braintree's Drop-In UI may qualify for SAQ-A — the simplest level with just 22 requirements. But 'reduced scope' is not 'zero scope' — merchants must still complete their applicable SAQ.
What is the difference between PCI DSS and PA-DSS?
PCI DSS applies to merchants and service providers that handle cardholder data. PA-DSS (Payment Application Data Security Standard) — now replaced by the Software Security Framework (SSF) — applied to payment application vendors whose software stores, processes, or transmits cardholder data. A merchant may be required to use PA-DSS validated payment software as part of their PCI DSS compliance.
What happens after a credit card data breach?
After a breach, the merchant must notify their acquiring bank, who notifies the card brands. A forensic investigation by a PCI Forensic Investigator (PFI) is typically required at Level 1. The merchant pays investigation costs, may be required to replace exposed cards (card brands charge $3–$15 per card), faces fines ($5,000–$50,000 in some cases), and may be placed in a remediation program.
Related Terms
SOC 2
A security audit standard developed by the AICPA assessing a service company's data security, availability, processing integrity, confidentiality, and privacy controls.
GDPR Compliance
Adherence to the EU's General Data Protection Regulation, governing how organizations collect, store, process, and transfer personal data of EU residents.
Payment Gateway
Software infrastructure that processes, verifies, and authorizes online and in-person payment transactions between merchants and customers.
Chargeback
A forced reversal of a payment transaction initiated by a customer through their bank, placing the financial liability back on the merchant.
