PCI DSS (Payment Card Industry Data Security Standard) is a security standard that organizations handling payment card data must follow to protect cardholder information: established by the major card networks and mandatory for any business that stores, processes, or transmits card data. It’s one of the most widely applicable security standards, since accepting card payments brings it into scope.

PCI DSS exists to reduce payment card fraud and data breaches by setting baseline security requirements for how card data is handled throughout its lifecycle.

What PCI DSS requires

PCI DSS is organized around a set of requirements (updated over time, currently PCI DSS v4.0) spanning: building and maintaining secure networks and systems, protecting stored cardholder data (encryption, minimizing what’s stored), maintaining a vulnerability management program, implementing strong access control measures, regularly monitoring and testing networks, and maintaining an information security policy. Compliance is validated through assessments scaled to the organization’s transaction volume.

The access control and identity requirements

Several PCI DSS requirements bear directly on identity and access management: restricting access to cardholder data on a need-to-know basis (least privilege), assigning unique IDs to each person with access (accountability), and, increasingly emphasized in v4.0, strong authentication, including multi-factor authentication for access to cardholder data environments. Strong identity and access controls are therefore a core part of PCI DSS compliance, not a peripheral concern. Modern authentication (MFA, and phishing-resistant methods) directly supports these requirements.

Why PCI DSS matters

PCI DSS is effectively mandatory for anyone accepting card payments, and non-compliance carries real consequences: fines, higher transaction fees, increased liability for breaches, and potentially losing the ability to process card payments. Beyond compliance, its requirements reflect sound security practice for protecting sensitive payment data. A breach of card data is costly and damaging, so PCI DSS provides a baseline that, properly implemented, meaningfully reduces that risk.

PCI DSS in context

PCI DSS focuses specifically on payment card data, complementing broader security and privacy frameworks (like the GDPR for personal data or DORA for operational resilience). Reducing PCI scope (by minimizing where card data is stored and processed, using tokenization, and applying strong access controls) is a common strategy to lower both risk and compliance burden. As with other standards, strong identity and access management is a foundational enabler of compliance.

Frequently asked questions

What is PCI DSS?

The Payment Card Industry Data Security Standard for protecting payment card data, mandatory for any business handling card data.

What does PCI DSS require?

Secure networks, protection of stored card data, vulnerability management, strong access control (including MFA), monitoring and testing, and a security policy.

How does PCI DSS relate to identity and access management?

It requires least-privilege access, unique IDs, and strong authentication (including MFA) for cardholder data environments.

What happens if you’re not PCI DSS compliant?

Fines, higher fees, greater breach liability, and potentially losing the ability to process card payments.

Does PCI DSS require MFA?

Yes, PCI DSS (especially v4.0) requires multi-factor authentication for access to cardholder data environments, among other access controls.

How can you reduce PCI DSS scope?

By minimizing where card data is stored and processed, using tokenization, and applying strong access controls to shrink the compliance footprint.

Related: Multi-Factor Authentication (MFA) · Principle of Least Privilege · Data Breach · Card-Not-Present (CNP) Fraud · Open Banking · GDPR