PCI DSS
What is PCI DSS?
The Payment Card Industry Data Security Standard is a set of security requirements for organizations that handle credit card information to protect cardholder data.
Terms that appear alongside pci dss
Each of these is named in at least one of the same controls as pci dss. The number is how many controls name both.
- nist 14 shared controls
- compliance 12 shared controls
- cybersecurity 9 shared controls
- iso 27001 8 shared controls
- integrity 7 shared controls
- soc 2 7 shared controls
- iec 27001 6 shared controls
- authentication 6 shared controls
Frameworks that govern pci dss
What the standards actually require on pci dss
Requirements naming pci dss across 6 standards, quoted from the control text.
When a significant change is complete, the entity must confirm that every applicable PCI DSS requirement is in place on all new or altered systems and networks, and must update documentation where relevant. It applies to all entities.
pci-dss-4-0::6.5.2 · 6.5.2 Confirm PCI DSS controls after significant change →Operate payment card data protection per the NRF framework + PCI DSS v4.0.1 + card brand operating rules (Visa + Mastercard + American Express + Discover + JCB + UnionPay + regional schemes).
NRFCS-3 · Payment Card Data Protection and PCI DSS Scope Management →Any truncated PAN sent back to the encryption environment keeps to the digits PCI DSS and its FAQs allow.
pci-p2pe::4B-1.8 · PCI P2PE 4B-1.8 →Security Dimension 1 Access Control per X.805 Clause 6.1: Access Control guards network resources against use without authorization, admitting only authorized staff or devices to services, applications, information flows, stored information and network element...
X805-Dim1-Access-Control-RBAC-Authorization-Resources-Network-Elements-Services-Applications · ITU-T X.805 Security Dimension 1 - Access Control + Role-Based Access Control (RBAC) + Authorization + Resources + Network Elements + Services + Applications + Access Limitations + Authorized Personnel + Discretionary + Mandatory Access Control →An acquiring bank is the risk-controlling entity throughout the credit card process whatever merchant acquirers, ISOs or member service providers it uses, and manages the credit, fraud, compliance and reputation risk of its merchant portfolio through merchant...
ffiec-it-examination-handbook::RPS-20 · Merchant Acquiring (Retail Payment Systems) →The cybersecurity program strategy identifies the compliance requirements the program must meet, for example NERC CIP, the TSA pipeline security guidelines, PCI DSS, ISO standards or DoD CMMC.
australian-energy-sector-cyber-security-framework-aescsf::PROGRAM-1g · PROGRAM-1g: Strategy identifies compliance requirements →Questions people ask about pci dss
What is PCI DSS?
Why is PCI DSS important for compliance?
Which compliance frameworks address PCI DSS?
Where can I learn more about PCI DSS?
See how PCI DSS applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.