Articles tagged pci dss
12 Practices to Protect Card Data, and What PCI DSS v4.0.1 Asks for Each
The PCI Security Standards Council's twelve data security practices for small merchants, each set against the PCI DSS v4.0.1 requirements that make it specific: password length, patch deadlines, terminal inspections, scans and more.
Approved Scanning Vendors (ASVs): The Quarterly External Scan, Its Scope, and Choosing a Provider
What PCI DSS v4.0.1 Requirement 11.3.2 asks of external vulnerability scans, what the Approved Scanning Vendor decides and what stays with you, how to scope a scan, and what to ask an ASV before signing.
Do You Need a PCI DSS Audit? Here's How to Determine If and When
Who needs a formal PCI DSS assessment by a QSA and who can self-assess: what the SAQ instructions say, why merchant levels come from the payment brands, and what the standard asks for between assessments.
Using Network Segmentation to Reduce PCI DSS Scope
What network segmentation does under PCI DSS v4.0.1: why the standard does not require it but scope depends on it, what counts as isolated, and the testing and yearly scope confirmation that keep it counting.
PCI Compliance 101: What PCI DSS v4.0.1 Is and How You Meet It
The basics of PCI DSS v4.0.1 for a business that takes cards: who it applies to, what counts as in scope, which card data may be stored, how compliance is validated, what changed in v4.x, and what has to happen between assessments.
PCI DSS Requirement 5.4.1: Protecting Personnel Against Phishing
What PCI DSS v4.0.1 Requirement 5.4.1 asks for: processes and automated mechanisms against phishing, who they must protect, how they are tested, where DMARC, SPF and DKIM fit, and how it differs from the phishing training in 12.6.3.1.
PCI DSS Requirement 8.2.8: Idle Timeout and Re-authentication
What PCI DSS v4.0.1 Requirement 8.2.8 asks for when a session sits idle for 15 minutes, how an assessor checks it, what its applicability notes exclude, and the controls it works alongside.
QR Code Phishing and PCI DSS
How QR code phishing works, in messages and on printed codes, which PCI DSS v4.0.1 requirements it touches, and what a business that displays QR codes for payment can do about tampering.
Understanding PCI DSS 11.6.1: Detecting Changes to Payment Pages
What PCI DSS v4.0.1 Requirement 11.6.1 asks for: a mechanism that alerts on unauthorised changes to a payment page's security-impacting HTTP headers and scripts as the browser receives them, how often it must run, who it applies to since SAQ A changed in January 2025, and the techniques the standard names.
HSTS and PCI DSS: What HTTP Strict Transport Security Does for a Payment Site
What HTTP Strict Transport Security protects against, how it relates to PCI DSS v4.0.1 Requirements 4.2.1 and 11.6.1 even though the standard does not name it, and how to deploy it and the preload list without breaking a site.
How to Select a Qualified Security Assessor (QSA) for PCI DSS
What a QSA does and does not do, how to confirm a company is on the PCI Security Standards Council's list, what to ask before engaging one, and where to send feedback about an assessor.
Should my Service Provider be PCI Compliant?
The PCI Security Standards Council's answer: Requirement 12.8 does not make your service providers validate as compliant, but any requirement a provider meets for you counts in your assessment. What to ask for, what the standard asks of them, and how to record who does what.
How iframes Simplify PCI DSS Compliance for E-commerce Businesses
How embedding a payment provider's form in an iframe affects PCI DSS v4.0.1 scope: which SAQ each e-commerce integration leads to, what the SAQ A script criterion asks of an iframe merchant under the Council's FAQ 1588, and what an iframe does not protect.
Storing CVV: What Merchants Need to Know
What PCI DSS v4.0.1 says about the card verification code: it may not be stored once authorisation completes, what is allowed before that, where it tends to hide, and what counts as a CVV and what does not.
What Happens If Your Third-Party Service Provider's AOC Is Nearly a Year Old?
What the PCI Security Standards Council says in FAQ 1601 about relying on a service provider's Attestation of Compliance when its assessment is close to a year old, and the processes your assessor will expect to see.
Choosing a PCI DSS Compliant Web Host for a Small Business
How to choose a web host when your site takes card payments: why the way your payment page is built matters more than the host, what a host's Attestation of Compliance does and does not cover, and what to ask before signing.
PCI DSS Resources from the Council and the Payment Brands
Where to find the primary sources for PCI DSS: the standard and its documents, the Council's lists of assessors and validated products, its training programmes, and the payment brands' own compliance programmes.