PCI DSS
Standard · $15K–$200K · 3–9 months
- Controls
- 12 requirements (PCI DSS v4.0)
- Recertification
- Annual validation (SAQ or ROC)
- Oversight
- PCI Security Standards Council; QSAs
- Common gaps
- Network segmentation, logging, key management
- Related
- SOC 2 Type 2
- Public registry
- PCI SSC ↗
What is PCI DSS?
PCI DSS is the security standard for organizations that store, process, or transmit payment-card data. Validation ranges from a self-assessment questionnaire (SAQ) to a full Report on Compliance (ROC) by a Qualified Security Assessor.
Is PCI DSS a certification or an attestation?
It is a standard enforced by the card brands; you validate annually rather than receiving a multi-year certificate.
Who needs PCI DSS?
Any business handling cardholder data; the validation level scales with transaction volume (merchant levels 1–4).
What does it cost and how long does it take?
Cost and effort scale with merchant level and scope; segmenting the cardholder data environment is the biggest lever.