PCI DSS Resources from the Council and the Payment Brands

PCI DSS has two kinds of primary source. The PCI Security Standards Council writes the standard and keeps the lists of assessors and validated products. The payment brands decide who must validate compliance, how, and what happens when they do not. This page links to both, and to nothing commercial. Where a question depends on your own arrangements, your acquirer is the one to ask.

The standard and its documents

• PCI DSS. The standard's page at the Council, with the current version and its supporting documents.
• Document library. The standard, the Self-Assessment Questionnaires and their instructions, the Attestation of Compliance forms, the Report on Compliance template and the Council's guidance documents.
• FAQs. The Council's answers to questions about applying the standard. An FAQ can settle a point the standard leaves open: FAQ 1588, for example, limits one of the SAQ A eligibility criteria to embedded payment forms.
• Glossary. The Council's definitions of the terms used across its standards.
• Merchant resources. The Council's starting point for merchants, including how the SAQs work.
• PCI Perspectives. The Council's blog, where changes such as the January 2025 update to SAQ A are announced.

The Council's lists

The program listings overview links every list. These are the ones most merchants and service providers use:

• Qualified Security Assessors, the companies qualified to assess PCI DSS compliance. See also QSA companies in Australia.
• Approved Scanning Vendors, the companies qualified to run the external vulnerability scans required by 11.3.2.
• Qualified Integrators and Resellers, trained to install and configure payment applications.
• PCI Forensic Investigators, the firms qualified to investigate a suspected account data compromise.
• Point-to-Point Encryption Solutions, the validated P2PE solutions.
• Approved PTS Devices and Validated Secure Software. Both open after accepting the Council's terms of use.
• Payment Applications, the old PA-DSS list. PA-DSS was retired on 28 October 2022, and every application on the list is now under "Acceptable Only for Pre-Existing Deployments". New software is validated under the Secure Software Standard instead.
• Verify a professional, to confirm that a named person holds a Council qualification.

Training and qualifications

The Council's training and qualification programmes include the PCI Professional (PCIP) qualification for individuals, and the Internal Security Assessor programme for staff of an organisation that assesses itself. The Council also runs events, including its community meetings.

The payment brands

Each brand runs its own compliance programme. The programmes set merchant and service provider levels, what each level must submit, and the consequences of not complying. The pages below are the brands' own; several are written for one country, so check the version for yours or ask your acquirer.

• Visa: the Account Information Security programme, and its Global Registry of Service Providers.
• Mastercard: the Site Data Protection programme.
• American Express: PCI compliance and data security, including its Data Security Operating Policy.
• Discover: the PCI compliance overview.
• JCB: the JCB Data Security Program.

Do you need a PCI DSS audit? explains how the brands' rules decide between a self-assessment and a Report on Compliance.

On this site

• The PCI DSS v4.0.1 reference, a page for every requirement with its testing procedures and what to prepare.
• The glossary, with the Council's definition cited where it has one.
• Find my SAQ, which works through the SAQ eligibility criteria.
• The 12 requirements of PCI DSS v4.0.1, for a first reading of the standard.