PCI DSS Compliance

PCI DSS – the Payment Card Industry Data Security Standard – is the global security standard that applies to any organisation storing, processing or transmitting payment card data. Developed and maintained by the PCI Security Standards Council (PCI SSC), it consists of 12 core requirements covering network security, data protection, vulnerability management, access controls, monitoring, testing and security policy. It is not UK statute law but is a contractual requirement from card brands and acquirers – non-compliance can affect your ability to take card payments and may trigger fines or increased transaction fees.

Being PCI DSS compliant means you have implemented the applicable controls and validated them – either via a Self-Assessment Questionnaire (SAQ) or a full QSA assessment – for the systems in scope for cardholder data, and can evidence the results to your acquirer or the relevant card brand.

Merchants are categorised into one of four levels based on annual transaction volume: Level 1 (over 6 million transactions), Level 2 (1 million to 6 million), Level 3 (20,000 to 1 million) and Level 4 (fewer than 20,000). Your level determines your validation requirements. CyberLab’s fixed-price packages cover Level 3 and Level 4 merchants – speak with our team if you are Level 1 or 2.

The CDE is everything – people, processes and technology – that stores, processes or transmits cardholder data or sensitive authentication data, and any systems that can affect its security. Correctly scoping the CDE is critical because PCI DSS applies fully inside that boundary. Reducing scope through network segmentation, tokenisation or outsourcing payment processing can significantly reduce your compliance burden.

PCI DSS v4.0.1 is the current active standard – v3.2.1 was retired on 31 March 2024. Key changes in v4.0 include broader multi-factor authentication requirements across access to the CDE, modernised terminology, a new customised approach option for meeting objectives, and stronger e-commerce controls (Requirements 6.4.3 and 11.6.1) to address payment-page script management and e-skimming. All v4.0 requirements became mandatory on 31 March 2025.

The practical steps are: scope correctly by identifying your CDE and everything that can impact it; map to the right SAQ or engage a QSA for a Report on Compliance (ROC) if required; implement the 12 requirements applicable to your scope; validate through SAQ completion or QSA assessment; complete required ASV scans; and repeat annually while embedding controls into business-as-usual processes.

There are 12 core requirements covering network security controls, system configuration, cardholder data protection, cryptography, vulnerability management, access control, physical security, monitoring and testing, and security policy.

PCI DSS is not a statutory legal requirement in the UK, but it is a contractual requirement imposed by card brands and acquirers. Non-compliance can result in monthly fines from your acquirer, increased transaction fees or loss of the ability to take card payments. You also have separate legal obligations under UK GDPR for the personal data involved in payment transactions.

Yes. PCI DSS is developed by the PCI SSC and used by payment stakeholders worldwide – it is the globally recognised baseline for securing payment card data.

To provide a baseline of technical and operational controls that protect cardholder data across the global payment ecosystem – reducing the likelihood and impact of payment data breaches, protecting customers and sustaining trust in card payment systems.

Beyond compliance, PCI DSS aligns closely with good security hygiene that protects your entire organisation. Controls implemented for PCI DSS – network segmentation, access management, vulnerability scanning, penetration testing – deliver security value well beyond the cardholder data environment, and support alignment with ISO 27001, Cyber Essentials and other frameworks.