What Is PCI DSS?
Definition
PCI DSS (Payment Card Industry Data Security Standard) is the security standard for any business that stores, processes, or transmits payment card data, or that could affect the security of that data. It is published by the PCI Security Standards Council (PCI SSC), and compliance is enforced through the card brands and your acquiring bank, not by a government agency.
How It Works
PCI SSC describes PCI DSS as "a baseline of technical and operational requirements designed to protect payment account data." It applies to merchants, processors, acquirers, issuers, and service providers.
Key points for a small merchant:
- Current version: PCI DSS v4.x. Version 3.2.1 was retired on March 31, 2024, and v4.0.1 followed in June 2024 as a limited revision with minor updates and clarifications.
- Future-dated requirements: of the 64 new requirements in v4.0, 51 were future-dated and became effective on March 31, 2025.
- How you prove it: smaller merchants often validate with a Self-Assessment Questionnaire (SAQ). PCI SSC states that whether an entity must comply or validate is up to the organizations that manage compliance programs, such as a payment brand or acquirer.
- E-commerce scripts: requirement 6.4.3 (authorize and inventory every script on payment pages) and 11.6.1 (detect unauthorized changes to payment pages) target card skimming. In January 2025, PCI SSC removed both from SAQ A but added an eligibility condition: the merchant must confirm the site is not susceptible to script attacks.
Real-World Example
The Justice Department's case against members of FIN7 shows what the standard is trying to prevent. In its August 2018 announcement of three arrests, DOJ said FIN7 had breached the networks of companies in 47 states and the District of Columbia, stealing more than 15 million customer card records from over 6,500 point-of-sale terminals at more than 3,600 business locations, mostly in the restaurant, gaming, and hospitality industries. The indictments describe carefully crafted emails, backed up by phone calls, that got an employee to open an attachment; malware then gave the group access to steal customers' card data, which it sold in underground marketplaces.
Why It Matters for a Small Business
PCI DSS is contractual, so the pressure arrives from your processor, not a regulator: SAQs, quarterly external vulnerability scans by an Approved Scanning Vendor where required, and questions after any suspected breach. PCI SSC notes that SAQ A e-commerce merchants are now expected to have ASV scans at least once every three months. The simplest way to shrink your scope is to never let card data touch your systems: use a hosted payment page or an iframe from a PCI DSS compliant provider, and keep that provider's confirmation on file.
How to Spot It / How DTS Handles It
Questions to answer: which SAQ applies to you; who your payment provider is and whether it is PCI DSS compliant; which scripts load on your checkout page; and whether anyone would notice if one changed. If you validate with SAQ A, keep a record of how you confirmed your site is not susceptible to script attacks.
DTS can help clients map where card data flows, reduce scope, review checkout scripts, and gather evidence for their SAQ. The SAQ is the merchant's own self-assessment, and QSA assessments are performed by qualified assessors, not DTS. Your acquiring bank or payment processor decides which validation you need. See our virtual CISO (vCISO) service.
Related Terms
- Card skimmer (Magecart): the attack that requirements 6.4.3 and 11.6.1 target.
- PCI SAQ: the self-assessment most small merchants complete.
- Vulnerability scanning: quarterly ASV scans are part of many SAQs.
- Malware: FIN7 used malware on point-of-sale systems.
- NIST Cybersecurity Framework (CSF 2.0): a broader framework that PCI controls fit into.
- Phishing: the common first step in card data breaches like FIN7.
Sources
- PCI Security Standards Council, PCI Data Security Standard (PCI DSS): https://www.pcisecuritystandards.org/standards/pci-dss/
- PCI SSC blog, Now is the Time for Organizations to Adopt the Future-Dated Requirements of PCI DSS v4.x (August 20, 2024): https://blog.pcisecuritystandards.org/now-is-the-time-for-organizations-to-adopt-the-future-dated-requirements-of-pci-dss-v4-x
- PCI SSC blog, Important Updates Announced for Merchants Validating to Self-Assessment Questionnaire A: https://blog.pcisecuritystandards.org/important-updates-announced-for-merchants-validating-to-self-assessment-questionnaire-a
- U.S. Department of Justice, Three Members of Notorious International Cybercrime Group "Fin7" In Custody for Role in Attacking Over 100 U.S. companies (August 1, 2018): https://www.justice.gov/opa/pr/three-members-notorious-international-cybercrime-group-fin7-custody-role-attacking-over-100
Last updated October 14, 2026.