PCI DSS articles and guides
All the latest blogs and news, straight from the team.
PCI QSA Companies in Australia: the Council's List, Explained
Which companies are qualified by the PCI Security Standards Council to assess PCI DSS compliance in Australia, straight from the Council's own list, and how to read and verify it.
Published
PCI DSS Requirement 5.4.1: Protecting Personnel Against Phishing
What PCI DSS v4.0.1 Requirement 5.4.1 asks for: processes and automated mechanisms against phishing, who they must protect, how they are tested, where DMARC, SPF and DKIM fit, and how it differs from the phishing training in 12.6.3.1.
Published
HSTS and PCI DSS: What HTTP Strict Transport Security Does for a Payment Site
What HTTP Strict Transport Security protects against, how it relates to PCI DSS v4.0.1 Requirements 4.2.1 and 11.6.1 even though the standard does not name it, and how to deploy it and the preload list without breaking a site.
Published
How to Select a Qualified Security Assessor (QSA) for PCI DSS
What a QSA does and does not do, how to confirm a company is on the PCI Security Standards Council's list, what to ask before engaging one, and where to send feedback about an assessor.
Published
How iframes Simplify PCI DSS Compliance for E-commerce Businesses
How embedding a payment provider's form in an iframe affects PCI DSS v4.0.1 scope: which SAQ each e-commerce integration leads to, what the SAQ A script criterion asks of an iframe merchant under the Council's FAQ 1588, and what an iframe does not protect.
Published
The 12 Requirements of PCI DSS v4.0.1, Explained
A plain reading of each of the twelve PCI DSS v4.0.1 requirements: what it protects, the controls that carry most of its weight, and the numbers it sets, with links to every requirement's controls.
Published
PCI DSS Resources from the Council and the Payment Brands
Where to find the primary sources for PCI DSS: the standard and its documents, the Council's lists of assessors and validated products, its training programmes, and the payment brands' own compliance programmes.
Published
Malware Protection for PCI DSS: What Requirement 5 Asks For
PCI DSS v4.0.1 Requirement 5 control by control: where anti-malware must run, what the periodic evaluation of systems not at risk involves, the choice between scans and behavioural analysis, removable media, logs, tamper protection and phishing.
Published
PCI DSS Requirement 8.2.8: Idle Timeout and Re-authentication
What PCI DSS v4.0.1 Requirement 8.2.8 asks for when a session sits idle for 15 minutes, how an assessor checks it, what its applicability notes exclude, and the controls it works alongside.
Published
What Happens If Your Third-Party Service Provider's AOC Is Nearly a Year Old?
What the PCI Security Standards Council says in FAQ 1601 about relying on a service provider's Attestation of Compliance when its assessment is close to a year old, and the processes your assessor will expect to see.
Published
Choosing a PCI DSS Compliant Web Host for a Small Business
How to choose a web host when your site takes card payments: why the way your payment page is built matters more than the host, what a host's Attestation of Compliance does and does not cover, and what to ask before signing.
Published
Email Authentication with SPF, DKIM and DMARC
What SPF, DKIM and DMARC each check, how they work together, what changed when RFC 9989 replaced the original DMARC specification in 2026, and where email authentication fits in PCI DSS v4.0.1.
Published
12 Practices to Protect Card Data, and What PCI DSS v4.0.1 Asks for Each
The PCI Security Standards Council's twelve data security practices for small merchants, each set against the PCI DSS v4.0.1 requirements that make it specific: password length, patch deadlines, terminal inspections, scans and more.
Published
Using Network Segmentation to Reduce PCI DSS Scope
What network segmentation does under PCI DSS v4.0.1: why the standard does not require it but scope depends on it, what counts as isolated, and the testing and yearly scope confirmation that keep it counting.
Published
PCI Compliance 101: What PCI DSS v4.0.1 Is and How You Meet It
The basics of PCI DSS v4.0.1 for a business that takes cards: who it applies to, what counts as in scope, which card data may be stored, how compliance is validated, what changed in v4.x, and what has to happen between assessments.
Published
Storing CVV: What Merchants Need to Know
What PCI DSS v4.0.1 says about the card verification code: it may not be stored once authorisation completes, what is allowed before that, where it tends to hide, and what counts as a CVV and what does not.
Published
Understanding PCI DSS 11.6.1: Detecting Changes to Payment Pages
What PCI DSS v4.0.1 Requirement 11.6.1 asks for: a mechanism that alerts on unauthorised changes to a payment page's security-impacting HTTP headers and scripts as the browser receives them, how often it must run, who it applies to since SAQ A changed in January 2025, and the techniques the standard names.
Published
How to Recognise and Avoid Phishing Attacks
The warning signs of a phishing message, the forms it takes, what to do if you have responded to one, and the PCI DSS v4.0.1 requirements that ask organisations handling card data to defend against it.
Published
QR Code Phishing and PCI DSS
How QR code phishing works, in messages and on printed codes, which PCI DSS v4.0.1 requirements it touches, and what a business that displays QR codes for payment can do about tampering.
Published
Approved Scanning Vendors (ASVs): The Quarterly External Scan, Its Scope, and Choosing a Provider
What PCI DSS v4.0.1 Requirement 11.3.2 asks of external vulnerability scans, what the Approved Scanning Vendor decides and what stays with you, how to scope a scan, and what to ask an ASV before signing.
Published
Do You Need a PCI DSS Audit? Here's How to Determine If and When
Who needs a formal PCI DSS assessment by a QSA and who can self-assess: what the SAQ instructions say, why merchant levels come from the payment brands, and what the standard asks for between assessments.
Published
Should my Service Provider be PCI Compliant?
The PCI Security Standards Council's answer: Requirement 12.8 does not make your service providers validate as compliant, but any requirement a provider meets for you counts in your assessment. What to ask for, what the standard asks of them, and how to record who does what.
Published