Articles tagged payment security
12 Practices to Protect Card Data, and What PCI DSS v4.0.1 Asks for Each
The PCI Security Standards Council's twelve data security practices for small merchants, each set against the PCI DSS v4.0.1 requirements that make it specific: password length, patch deadlines, terminal inspections, scans and more.
Do You Need a PCI DSS Audit? Here's How to Determine If and When
Who needs a formal PCI DSS assessment by a QSA and who can self-assess: what the SAQ instructions say, why merchant levels come from the payment brands, and what the standard asks for between assessments.
PCI Compliance 101: What PCI DSS v4.0.1 Is and How You Meet It
The basics of PCI DSS v4.0.1 for a business that takes cards: who it applies to, what counts as in scope, which card data may be stored, how compliance is validated, what changed in v4.x, and what has to happen between assessments.
QR Code Phishing and PCI DSS
How QR code phishing works, in messages and on printed codes, which PCI DSS v4.0.1 requirements it touches, and what a business that displays QR codes for payment can do about tampering.
Understanding PCI DSS 11.6.1: Detecting Changes to Payment Pages
What PCI DSS v4.0.1 Requirement 11.6.1 asks for: a mechanism that alerts on unauthorised changes to a payment page's security-impacting HTTP headers and scripts as the browser receives them, how often it must run, who it applies to since SAQ A changed in January 2025, and the techniques the standard names.
Should my Service Provider be PCI Compliant?
The PCI Security Standards Council's answer: Requirement 12.8 does not make your service providers validate as compliant, but any requirement a provider meets for you counts in your assessment. What to ask for, what the standard asks of them, and how to record who does what.
What Happens If Your Third-Party Service Provider's AOC Is Nearly a Year Old?
What the PCI Security Standards Council says in FAQ 1601 about relying on a service provider's Attestation of Compliance when its assessment is close to a year old, and the processes your assessor will expect to see.
Choosing a PCI DSS Compliant Web Host for a Small Business
How to choose a web host when your site takes card payments: why the way your payment page is built matters more than the host, what a host's Attestation of Compliance does and does not cover, and what to ask before signing.
PCI DSS Resources from the Council and the Payment Brands
Where to find the primary sources for PCI DSS: the standard and its documents, the Council's lists of assessors and validated products, its training programmes, and the payment brands' own compliance programmes.