PCI DSS
PCI DSS (Payment Card Industry Data Security Standard) is a set of security requirements established by major card networks, including Visa, Mastercard, Amex, Discover, and JCB, for any organization that stores, processes, or transmits cardholder data. It is designed to protect payment card information from theft and fraud.
PCI DSS applies to any organization that handles cardholder data: primary account numbers (PANs), cardholder names, card expiry dates, or service codes. The standard defines 12 requirements across six control objectives: build and maintain a secure network, protect cardholder data, maintain a vulnerability management program, implement strong access controls, monitor and test networks, and maintain an information security policy.
PCI compliance is assessed at different levels based on transaction volume. Level 1 merchants (processing more than 6 million transactions annually) require an on-site assessment by a Qualified Security Assessor (QSA). Lower levels complete Self-Assessment Questionnaires (SAQs). Different SAQ variants apply based on how cardholder data is handled. SAQ-A for e-commerce merchants using hosted payment pages has significantly fewer requirements than SAQ-D for merchants storing cardholder data.
Tokenization and hosted payment fields are the primary tools for minimizing PCI scope. Merchants using hosted payment pages, where card data is entered on the processor's page rather than the merchant's, reduce their compliance scope to SAQ-A. Merchants who store card data face the full requirements including network segmentation, encryption at rest, and access controls.
PCI DSS compliance is a contractual requirement for any merchant or payment service provider accepting card payments. The requirement is imposed by the card networks through their merchant and acquirer agreements. Non-compliance carries fines from card networks ranging from $5,000 to $100,000 per month for merchants and acquirers failing to comply, and in the event of a data breach, non-compliant merchants bear full liability for fraud losses.
- Scope management is the primary challenge: cardholder data 'sprawls' into systems through logging, debugging, and integration flows
- Annual assessment costs are significant for Level 1 entities requiring QSA engagement
- PCI requirements change with new standard versions (PCI DSS v4.0 introduced in 2022) requiring ongoing compliance program updates
- Multi-environment compliance requires consistent security controls
- Cloud infrastructure PCI compliance requires understanding shared responsibility models with cloud providers
A marketplace platform previously storing card PANs for recurring payments migrates to network tokenization and a hosted payment page for new card entry. PCI scope reduces from SAQ-D (the most comprehensive SAQ, covering 300+ controls) to SAQ-A (22 controls). Annual QSA assessment costs reduce from £180,000 to £18,000. Engineering time previously allocated to PCI compliance maintenance is redirected to product development.
Related Concepts
Nium is PCI DSS Level 1 certified, the highest compliance level, covering its card issuing, payment processing, and data management infrastructure. Platform partners integrating Nium's hosted card input components and tokenization reduce their own PCI scope, as cardholder data is handled within Nium's PCI-certified environment rather than the partner's systems.
Answers you didn't know you needed.
What does PCI DSS stand for?
Payment Card Industry Data Security Standard. It is maintained by the PCI Security Standards Council, which was founded by American Express, Discover, JCB, Mastercard, and Visa.
Who must comply with PCI DSS?
Any organization that stores, processes, or transmits cardholder data, including merchants, payment service providers, card issuers, acquirers, and technology providers handling cardholder data. Compliance level requirements vary based on transaction volume.
What is a QSA?
A Qualified Security Assessor is an organization certified by the PCI Security Standards Council to conduct Level 1 PCI DSS assessments. QSAs perform on-site evaluations of security controls and issue Reports on Compliance (ROCs).
What are the PCI DSS compliance levels?
Level 1: 6M+ transactions annually (full QSA assessment). Level 2: 1-6M transactions (SAQ + quarterly scans). Level 3: 20K-1M e-commerce transactions (SAQ + quarterly scans). Level 4: Fewer than 20K e-commerce or 1M total transactions (SAQ).
Does using Nium's infrastructure affect my PCI scope?
Yes. Using Nium's hosted card input components and tokenization means cardholder data is handled within Nium's PCI-certified environment. This significantly reduces your PCI scope, typically to SAQ-A, as your systems do not directly handle PANs.