PCI DSS
Standard for protecting payment cardholder data and card processing controls.
PCI DSS is the standard for protecting payment cardholder data. It applies where organisations' systems store, process or transmit card numbers and sets baseline technical and operational requirements for networks, systems, applications and third-party processing.
It raises practical challenges around scoping and reducing the cardholder data environment, network segmentation, strong access controls, encryption, logging and timely patching. Use of cloud services and third-party processors complicates control ownership and evidence for assessments.
PCI DSS: access, authentication and privileged account controls
Authentication, authorisation and privileged access limits to protect cardholder data and meet PCI DSS control expectations.
PCI DSS — Audit evidence and supporting records
Maintain logs, records and reports that show controls are operating and can be presented as PCI DSS audit evidence.
PCI DSS controls for data protection and handling
Sets out controls for classifying, transferring, retaining and protecting cardholder data under PCI DSS.
PCI DSS governance, accountability and policy enforcement
Identify who is accountable for cardholder data controls, enforce PCI DSS policies and keep compliance evidence for review.
Where PCI DSS fits
Controls span payment gateways, point-of-sale and e-commerce components, databases, logs, backups and any system that touches cardholder data. Tokenisation, encryption and network segmentation are common integration points with broader IT.
Consider PCI DSS when designing architecture, procurement and change processes, and when using cloud or managed services, because it affects scope and control responsibilities. Incident response, forensic work and regulatory reporting remain the organisation's responsibility, and assessments often require external validation.