PCI DSS

What it means

PCI DSS is the Payment Card Industry Data Security Standard. It sets technical and operational requirements for any organisation that stores, processes or transmits payment card data, or that can affect the security of the systems that do. It is organised into twelve principal requirements, from firewalls and encryption to testing and policy.

The standard is maintained by the PCI Security Standards Council, which the major card brands set up. The council writes the rules but does not enforce them. Enforcement comes through the banks and payment processors you work with, who can ask for proof and set consequences.

Why it matters

Handling cards without meeting the standard can mean fines passed on by your bank, higher processing fees, extra audits or, in the worst case, losing the ability to take cards. After a breach the consequences are heavier, because investigators check what you had in place.

Reducing scope is the cheapest protection. If a hosted payment page keeps card numbers away from your servers, far fewer systems fall under the standard. Even then, your site can still be altered to skim cards, which is why third-party scripts on payment pages deserve attention.

How it shows up

In an application it shows up as concrete engineering. Encryption in transit, no card numbers in logs, strong access control, patching, secure development practice and regular testing. Requirement 11.4 covers penetration testing, and other requirements cover scanning, logging and change control.

Mistakes repeat. A card number appears in an error message or a debug log. A test environment uses real data. A script added by marketing runs on the payment page. Scope is drawn too narrowly and a connected system is missed. Draw the data-flow first, then decide what is in scope.