PCI DSS Glossary

A comprehensive reference of terms and definitions related to the Payment Card Industry Data Security Standard (PCI DSS).

A

Access Control: The process of granting or denying specific requests to obtain and use information and related information processing services.
Access Control List (ACL): A list of permissions attached to an object, specifying which users or system processes are granted access to the object and what operations are allowed.
Account Data: The umbrella term for all data that PCI DSS protects. Account Data comprises Cardholder Data (primary account number, cardholder name, expiration date and service code) and Sensitive Authentication Data (full track data, card verification codes, and PINs or PIN blocks). The split matters: Cardholder Data may be stored where there is a documented business need and it is rendered unreadable, whereas Sensitive Authentication Data must never be retained once authorization completes.
Acquirer: A financial institution that processes payment card transactions on behalf of merchants. The acquirer is responsible for ensuring that the merchants it works with comply with PCI DSS requirements.
Active Directory: A Microsoft directory service used to manage users, computers, and other devices on a network. It helps enforce access control and authentication policies.
Advanced Encryption Standard (AES): A widely-used symmetric encryption algorithm that supports key lengths of 128, 192, and 256 bits. AES is considered secure and is used to protect sensitive data, including cardholder data.
Algorithm: A set of rules or steps used to solve a problem or perform a task, such as encrypting or decrypting data.
Anomaly Detection: The process of identifying unusual patterns or behaviors within a dataset or system, which may indicate a security threat or compromise.
Anti-Malware: Software designed to detect, prevent, and remove malicious software, such as viruses, worms, and ransomware.
Application Layer Firewall: A firewall that operates at the application layer of the OSI model, filtering traffic based on the content of the data packets, rather than just the source and destination IP addresses.
Application Security: The process of ensuring the security of software applications by identifying and mitigating vulnerabilities, implementing secure coding practices, and using security testing tools.
Approved Scanning Vendor (ASV): A third-party organization that has been authorized by the Payment Card Industry (PCI) Security Standards Council to perform external vulnerability scanning services for PCI DSS compliance.
Asset: Any item of value to an organization, such as hardware, software, data, or intellectual property.
Asymmetric Encryption: Encryption using a matched pair of keys: a public key that can be shared freely and a private key that must be protected. Data encrypted with one can be decrypted only with the other, which is what allows both confidential exchange and digital signatures. Also known as public key cryptography. It is far slower than symmetric encryption, so in practice it is used to establish or protect a symmetric key, which then does the bulk of the work. This is how TLS operates.
Attack Surface: The set of points in a system where an attacker can attempt to gain unauthorized access, exploit vulnerabilities, or compromise the system.
Attestation of Compliance (AOC): A formal document that attests an organization's adherence to PCI DSS requirements. The AOC is completed by either a Qualified Security Assessor (QSA) or an organization's internal security assessor and is submitted to the acquirer as proof of compliance.
Attestation of Scan Compliance: The document an Approved Scanning Vendor issues to summarise the outcome of an external vulnerability scan, stating whether the scan passed and confirming that the scan customer and the ASV agree the scope was complete. It accompanies the executive summary and the detailed vulnerability report, and together these form the quarterly external scanning evidence submitted with an SAQ or Report on Compliance. A passing scan is required, not merely a completed one.
Audit: A systematic examination of an organization's security controls, policies, and procedures to ensure compliance with a given set of standards, such as PCI DSS.
Audit Log / Audit Trail: A chronological record of activity on a system: who did what, to which resource, from where and when. PCI DSS Requirement 10 sets out what must be captured for system components in scope, including all access to account data, all actions taken by users with administrative privilege, access to the logs themselves, invalid access attempts, changes to accounts and credentials, and the starting, stopping or pausing of logging. Logs must be protected against alteration, retained for at least 12 months, and the most recent three months kept immediately available for analysis. Audit logs are often the only evidence available after a compromise, which is why their integrity is treated as a control in its own right.
Authenticated Internal Vulnerability Scan: An internal vulnerability scan performed with credentials that let the scanner log in to each system component and inspect it from the inside, rather than probing it only across the network. Authenticated scanning finds missing patches, insecure local configurations and vulnerable packages that an unauthenticated scan cannot see. PCI DSS Requirement 11.3.1.2 requires internal scans to be authenticated, with the scanning credentials managed under the same protections as any other privileged account. This was future-dated at publication and became mandatory on 31 March 2025.
Authentication: The process of verifying the identity of a user, device, or system attempting to access a resource.
Automated Log Review: The use of tooling, such as a SIEM or log analytics platform, to review audit logs and surface anomalies, rather than relying on people reading logs by hand. PCI DSS Requirement 10.4.1.1 requires automated mechanisms for the daily review of security-critical logs, on the reasoning that manual review does not scale to the log volume a modern environment produces. This was future-dated at publication and became mandatory on 31 March 2025.

B

Backdoor: A hidden method of bypassing normal authentication or security controls to gain unauthorized access to a system, often created by an attacker or included intentionally by developers for debugging purposes.
Backup: A copy of data, software, or system configurations that can be used to restore the original in the event of data loss, corruption, or system failure.
Banner Grabbing: A technique used by attackers to gather information about a target system, such as the operating system or software versions, by analyzing the banners or other messages sent by the system during the connection process.
Baseline Security: A set of minimum security measures or controls implemented to protect an organization's information systems and data from threats.
Bespoke and Custom Software: The v4.x term for software written for one organization rather than sold off the shelf. Bespoke software is built for the entity by a third party, to specifications the entity sets; custom software is built by the entity for its own use. Both fall under Requirement 6, covering secure development practices, code review, vulnerability management and change control. The distinction from off-the-shelf and third-party software matters because the entity carries responsibility for the security of code written on its behalf.
Biometrics: The use of unique physical or behavioral characteristics, such as fingerprints or facial recognition, to identify and authenticate individuals.
Block List (Blacklist): A list of entities, such as IP addresses, domains or applications, that are denied access to a system because they are known or suspected to be malicious. Block lists are reactive: anything not listed is permitted, so they cannot catch a threat that has not been seen before. Block list and allow list are the current terms; the older blacklist and whitelist wording is being retired across the industry and in PCI SSC documentation.
Bluetooth: A wireless technology standard used for exchanging data between devices over short distances, which may pose security risks if not properly secured.
Botnet: A network of compromised computers, servers, or other devices that are remotely controlled by an attacker to perform malicious activities, such as launching distributed denial-of-service (DDoS) attacks.
Brute Force Attack: An attempt to crack a password or encryption key by systematically trying every possible combination of characters until the correct one is found.
Buffer Overflow: A vulnerability that occurs when an application writes more data to a buffer than it can hold, causing the excess data to overwrite adjacent memory locations and potentially leading to unauthorized access or system crashes.
Bug: A flaw or error in software or hardware that can lead to unexpected behavior, security vulnerabilities, or system crashes.
Business Continuity Plan (BCP): A documented plan outlining the steps an organization will take to ensure the continued availability of critical functions and systems in the event of a disruption or disaster.
Business Impact Analysis (BIA): A process used to identify and assess the potential impact of a disruption on an organization's critical functions and systems, helping prioritize recovery efforts and develop business continuity plans.
BYOD (Bring Your Own Device): A policy that allows employees to use their personal devices, such as smartphones or laptops, for work-related activities, which may introduce security risks if not properly managed and secured.
Byte: A unit of digital information consisting of eight bits, commonly used to represent a single character of text or other data.

C

Card Testing: An attack in which stolen card numbers are validated in bulk by pushing large volumes of small or zero-value authorizations through a merchant payment form, to find out which cards still work before they are used elsewhere. The merchant is collateral damage rather than the target, but bears the authorization costs, the chargebacks and the risk to its acceptance. PCI DSS v4.x expects public-facing web applications to be protected against automated attacks of this kind.
Card Verification Code (CVC)/Card Verification Value (CVV): A three or four-digit value carried by a payment card and used to check that the card itself is in the hands of the person making the transaction. Two different values share the name. CVV1 (CVC1) is encoded in the magnetic stripe and validates card-present transactions. CVV2 (CVC2), called CID by American Express and Discover and CAV2 by JCB, is printed on the signature panel or card face and is used for card-not-present transactions such as e-commerce and MOTO. Both are Sensitive Authentication Data, so PCI DSS prohibits storing either after authorization, even in encrypted form.
Card-Not-Present Transaction (CNP): A transaction where the card is not physically read by a terminal, covering e-commerce, mail order and telephone order. Because the chip cannot be used to prove the card is genuine, CNP transactions rely on data the cardholder supplies, such as the card verification value, address verification and 3-D Secure. CNP is where card fraud concentrated after EMV adoption, and it is the channel most PCI DSS e-commerce requirements are written to address.
Card-Present Transaction: A transaction where the physical card or a provisioned device is at the point of sale and is read by a terminal, whether by chip, contactless or magnetic stripe. Card-present acceptance generally carries lower fraud risk and lower interchange than card-not-present, and it shapes which Self-Assessment Questionnaire applies, since the relevant questionnaires turn on how the card is read and what the merchant systems touch.
Cardholder Data: Sensitive information associated with a payment card, such as the primary account number (PAN), cardholder name, expiration date, and service code. Abbreviated CHD.
Cardholder Data Environment (CDE): The set of systems, networks, and processes that store, process, or transmit cardholder data, as well as any connected systems that could impact the security of cardholder data. PCI DSS requirements apply to all components within the CDE.
Certificate Authority (CA): A trusted organization that issues digital certificates to verify the identity of websites, individuals, or organizations, and ensure secure communication through encryption.
Change Management: The process of controlling and documenting changes to systems, software, or hardware to minimize the risk of disruptions, security vulnerabilities, or unauthorized modifications.
Change-and-Tamper Detection Mechanism: A control that watches a payment page as the consumer's browser actually receives it and alerts on unauthorized modification to its HTTP headers or its contents. PCI DSS Requirement 11.6.1 requires such a mechanism on payment pages, evaluated at least weekly or at a frequency justified by a targeted risk analysis. It exists to catch client-side skimming, where an attacker alters a page or an included script to harvest card data before it is ever submitted to the merchant. This was future-dated at publication and became mandatory on 31 March 2025.
Chargeback: A forced reversal of a card transaction, initiated by the issuer on the cardholder behalf, typically because the transaction is disputed as fraudulent, unauthorized or not as described. Chargebacks carry fees and, above brand thresholds, can put a merchant into a monitoring program or cost it card acceptance. Sustained chargeback volume is often the first outward sign of a card data compromise, which is why chargeback trends are watched as a fraud indicator rather than purely as a finance matter.
Checksum: A value calculated from a data set, such as a file or message, used to verify its integrity by detecting errors or alterations in the data.
Cipher: An algorithm used to encrypt or decrypt data, transforming it into an unreadable format to protect its confidentiality.
Ciphertext: Data that has been encrypted and is unreadable until decrypted using the appropriate key or algorithm.
Cloud Computing: The delivery of computing services, such as storage, processing power, and applications, over the internet from remote data centers, which may introduce new security risks and compliance considerations.
Compensating Control Worksheet (CCW): The template, provided in PCI DSS Appendix C, used to document every compensating control. It records the constraint that prevents the requirement being met as written, the objective of the original requirement, the additional risk created by the deviation, the control put in place, how that control was validated, and how it will be maintained. A compensating control that is not documented in a completed worksheet and validated by the assessor at each assessment does not stand.
Compensating Controls: Alternative controls used when an organization cannot meet a PCI DSS requirement as written because of a documented technical or business constraint. A compensating control must go beyond what the original requirement demands, address the extra risk the deviation creates, and be recorded in a Compensating Control Worksheet that an assessor reviews and validates at every assessment. Compensating controls are not the same as the Customized Approach introduced in v4.0: a compensating control exists because a requirement cannot be met, while the Customized Approach is a deliberate design decision to meet the requirement objective by a different method.
Compliance: The process of adhering to established regulations, standards, or policies, such as PCI DSS, to ensure the security of sensitive data and the proper functioning of information systems.
Confidentiality: The principle of ensuring that sensitive information is accessible only to authorized individuals, systems, or entities, and is protected from unauthorized access or disclosure.
Connected-to or Security-Impacting System: A system component that does not store, process or transmit account data itself but can still affect the security of the cardholder data environment, and is therefore in scope for PCI DSS. Typical examples are directory services, name resolution, patch and configuration management servers, monitoring and logging platforms, and administrative jump servers. PCI DSS scoping recognises three categories: CDE systems, connected-to or security-impacting systems, and out-of-scope systems. Underestimating this middle category is one of the most common scoping errors.
Contactless Payment: A transaction where the card or device is tapped against a terminal rather than inserted or swiped, using near-field communication. Contactless payments carry the same EMV cryptographic protections as chip transactions and are treated as card-present. The account data involved is in scope for PCI DSS in the same way as any other acceptance channel.
Controls Matrix: The document an organization produces for each requirement it meets through the Customized Approach, describing the control in place, how it meets the customized approach objective, how its effectiveness is tested and maintained, and who is accountable for it. Together with the targeted risk analysis, the controls matrix is what an assessor uses to derive bespoke testing procedures for that control. PCI DSS Appendix E provides a sample template.
CPoC (Contactless Payments on COTS): A PCI Security Standards Council standard for solutions that accept contactless payments using the built-in NFC reader of an ordinary phone or tablet, with no additional hardware. CPoC solutions do not accept a PIN. As with SPoC, only solutions listed by the council qualify.
Cross-site Scripting (XSS): A type of web application vulnerability where an attacker injects malicious scripts into trusted websites, causing them to be executed by a victim's browser and potentially leading to data theft or unauthorized actions.
Cryptographic Architecture: A documented description of how cryptography is used across an environment: the algorithms, protocols and cipher suites in use, the keys and certificates involved, where each is applied, and the plan for responding when an algorithm or protocol weakens. PCI DSS Requirement 12.3.3 requires all entities to document and review the cipher suites and protocols in use at least once every 12 months, so that a deprecation such as the retirement of TLS 1.0 or SHA-1 is acted on rather than discovered during an assessment. Requirement 3.6.1.1 places a fuller cryptographic architecture obligation on service providers. Requirement 12.3.3 was future-dated at publication and became mandatory on 31 March 2025.
Cryptographic Key: A value used with a cryptographic algorithm to transform data, most commonly to encrypt or decrypt it. Symmetric cryptography uses the same key for both operations; asymmetric cryptography uses a matched public and private pair. Under PCI DSS a key is not simply a value but a managed object: it has a defined cryptoperiod, a named custodian, storage restricted to the fewest possible locations, and a defined point of retirement or replacement. Keys that protect account data must themselves be protected, typically by a key encrypting key or a hardware security module.
Cryptographic Key Generation: The process of creating secret cryptographic keys used in combination with cryptographic algorithms to encrypt and decrypt data. PCI DSS requires organizations to use strong and unique keys
Cryptography: The practice of securing communication and data storage by using mathematical techniques to encrypt and decrypt information, ensuring its confidentiality, integrity, and authenticity.
Cryptoperiod: The defined period during which a specific cryptographic key is authorised for use, after which it must be retired and replaced. PCI DSS requires a cryptoperiod to be defined for every key protecting account data, and requires keys to be changed at the end of it. The length is set by the organization, based on how much data the key protects, how exposed it is and the strength of the algorithm, and the reasoning must be documented rather than assumed. A shorter cryptoperiod limits how much data a single compromised key can expose.
Customer Information: Any data related to customers, such as names, addresses, phone numbers, or email addresses, that may be subject to privacy regulations and require protection from unauthorized access or disclosure.
Customized Approach: A method introduced in PCI DSS v4.0 that lets an organization meet the stated objective of a requirement through controls of its own design, rather than by implementing the requirement exactly as written. It is aimed at mature environments using technologies or architectures the standard did not anticipate. Using it requires a targeted risk analysis, a documented controls matrix, and an assessor who derives and performs bespoke testing procedures. Not every requirement is eligible, and those that are not are marked in the standard. Because it depends on assessor-designed testing, the customized approach is used in assessments documented in a Report on Compliance rather than in a Self-Assessment Questionnaire. It is distinct from a compensating control, which exists because a requirement cannot be met at all.
Customized Approach Objective: The security outcome a PCI DSS requirement is intended to achieve, stated in the standard alongside each eligible requirement. Under the Customized Approach an organization is not implementing the requirement as written, so the objective becomes the thing it must demonstrate it meets. Requirements published without a customized approach objective are not eligible for the customized approach.
CVE (Common Vulnerabilities and Exposures): The public catalogue of disclosed security vulnerabilities, each given a unique identifier in the form CVE-YYYY-NNNNN. CVE identifiers give scanners, vendors, advisories and assessors a common reference for the same flaw, which is what makes vulnerability tracking, patch verification and scan evidence comparable across different tools.
CVSS (Common Vulnerability Scoring System): An open standard, maintained by FIRST, that scores the severity of a vulnerability from 0.0 to 10.0. PCI DSS uses it as an input to the risk ranking required for vulnerability management, and the ASV Program Guide uses it directly: on an external scan, a vulnerability with a CVSS base score of 4.0 or above is normally an automatic failing condition. A score alone is not a risk ranking, though. An organization is expected to weigh the score against its own environment and record how it reached its conclusion.
Cybersecurity: The practice of protecting computers, networks, and data from digital threats, such as unauthorized access, data breaches, malware, or denial-of-service attacks.

D

Data Breach: An incident in which unauthorized individuals gain access to sensitive information, such as payment card data, personal information, or intellectual property.
Data Encrypting Key (DEK): The cryptographic key that actually encrypts and decrypts stored or transmitted data, as distinct from a key encrypting key that protects other keys. Under PCI DSS a data encrypting key must be protected wherever it exists, held in the fewest possible locations, and rotated at the end of its defined cryptoperiod.
Data Encryption Standard (DES): A widely used symmetric-key encryption algorithm, now considered insecure due to its relatively short key length and susceptibility to brute-force attacks.
Data Flow Diagram: A visual representation of how data moves through an organization's systems and processes, often used to identify potential security risks or vulnerabilities.
Data Loss Prevention (DLP): Technologies and processes designed to prevent the unauthorized disclosure, alteration, or destruction of sensitive information, both in transit and at rest.
Default Account: A pre-configured user account, often created by software vendors or system administrators, which may have known usernames and passwords, increasing the risk of unauthorized access if not properly managed.
Default Password: A pre-set password provided by software vendors or hardware manufacturers, which should be changed by the user to prevent unauthorized access.
Defined Approach: The traditional method of meeting PCI DSS, in which an organization implements each requirement as written and the assessor tests it against the defined testing procedures published in the standard. It remains the default, and it is the only route available to an organization completing a Self-Assessment Questionnaire. Compensating controls are available under the defined approach; they have no equivalent under the Customized Approach.
Denial of Service (DoS): An attack that overwhelms a system, network, or service with excessive traffic or requests, rendering it unavailable to legitimate users.
Digital Certificate: An electronic document issued by a certificate authority (CA) that verifies the identity of a website, individual, or organization and enables secure communication through encryption.
Digital Signature: A cryptographic technique used to verify the authenticity and integrity of a message, document, or software, by ensuring it has not been altered and was created by a specific sender.
Directory Traversal: A type of cyberattack where an attacker exploits vulnerabilities in web applications to access restricted directories and files, potentially leading to unauthorized access to sensitive information.
Discretionary Data: Additional issuer-defined data held in the tracks of a payment card magnetic stripe beyond the standard fields, including the card validation value CVV1 or CAV1. Because it carries that validation value, discretionary data forms part of Sensitive Authentication Data and must never be retained after authorization.
Disk Encryption: See Full-Disk Encryption (FDE) under F for the full definition.
Distributed Denial of Service (DDoS): A coordinated denial of service attack, where multiple systems are used to flood a target with excessive traffic or requests, overwhelming its resources and causing it to become unavailable.
DMZ (Demilitarized Zone): A network segment, often positioned between an organization's internal network and the internet, where public-facing systems are isolated to limit exposure and reduce the potential impact of a security breach.
Domain Name System (DNS): A hierarchical system for translating human-readable domain names (such as example.com) into the IP addresses used by computers to identify each other on the internet.
Dual Control: A security principle that requires two or more individuals to perform certain actions, such as approving a transaction or accessing sensitive information, to reduce the risk of fraud or error.
DUKPT (Derived Unique Key Per Transaction): A key management scheme in which every transaction is encrypted under a distinct key derived from a base key and a transaction counter, so no two transactions share a key and a compromised key exposes only one transaction. DUKPT is widely used in PIN entry devices and point-to-point encryption solutions, and it means a captured key cannot be used to decrypt earlier or later traffic.

E

E-commerce: The buying and selling of goods and services over the internet, which may involve the processing of payment card data and require adherence to PCI DSS standards.
E-Skimming: The online equivalent of skimming, also known as digital skimming, formjacking or Magecart. An attacker injects or modifies JavaScript on a checkout page so that card details are copied to an attacker-controlled destination as the customer types them, while the payment itself completes normally. Because the data is taken in the browser before submission, server-side controls and payment provider security do not detect it. PCI DSS v4.x addresses this directly through the payment page script and change-and-tamper detection requirements.
EMV (Chip Card): The global standard for chip-based payment cards and the terminals that accept them, named after Europay, Mastercard and Visa. An EMV chip generates a unique cryptogram for every transaction, so intercepted data from one payment cannot be replayed as another. This makes counterfeit card fraud impractical at chip-accepting terminals and is why fraud migrated toward card-not-present channels as EMV rolled out. EMV does not by itself take a merchant out of PCI DSS scope: the primary account number is still present and still requires protection.
Encryption: The process of converting data into a coded form, using an encryption algorithm, to protect it from unauthorized access or tampering.
Encryption Algorithm: A mathematical formula used to encrypt and decrypt data, ensuring that only authorized parties with the correct decryption key can access the original information.
Encryption Key: A cryptographic key used specifically to encrypt and decrypt data, as opposed to keys used for signing, message authentication or wrapping other keys. See Cryptographic Key under C for how symmetric and asymmetric keys differ, and Key Management for the controls PCI DSS places around key generation, storage, rotation and retirement.
Endpoint Security: The practice of protecting devices such as computers, smartphones, and tablets from threats, vulnerabilities, and unauthorized access when connected to a network.
Enterprise Security: The strategies, policies, and technologies used to protect an organization's information, systems, and infrastructure from internal and external threats.
Event Log: See Audit Log / Audit Trail under A for the full definition.
Exfiltration: The unauthorized transfer or removal of data from a system or network, often as part of a cyberattack or data breach.
Exploit: A piece of software, a set of data, or a sequence of commands that takes advantage of a vulnerability in a system or application to cause unintended behavior or gain unauthorized access.
Extended Validation (EV) SSL Certificate: A type of digital certificate that provides a higher level of assurance regarding the identity of a website, organization, or individual by requiring more rigorous validation processes.
External Vulnerability Scanning: Scanning performed from outside the network against every internet-facing IP address and domain in scope, to find what an attacker on the internet could reach. PCI DSS requires these scans at least once every three months and after any significant change and, unlike internal scanning, they must be performed by an Approved Scanning Vendor. A passing result is required: under the ASV Program Guide a vulnerability with a CVSS base score of 4.0 or above normally fails the scan, so findings must be remediated and the scan repeated until it passes. Scope completeness is agreed between the scan customer and the ASV, and getting it right is the responsibility of the organization, not the vendor.
Extranet: A private network that allows controlled access to authorized external users, such as business partners, customers, or suppliers, while maintaining security and privacy.

F

Failover: A backup operational mode in which the functions of a system component are assumed by a secondary component when the primary component becomes unavailable due to failure or scheduled maintenance.
False Negative: A failure of a security system to detect or alert on a malicious activity or event, allowing the threat to go unnoticed and potentially cause harm.
False Positive: An alert or detection by a security system that incorrectly identifies a benign activity or event as malicious, potentially leading to unnecessary investigations or actions.
Federated Identity: A method of linking and managing a user's identity across multiple systems or organizations, allowing for single sign-on (SSO) and simplified access control.
File Integrity Monitoring: A security process that involves monitoring and detecting changes to files and system components, such as configuration files or application binaries, to identify unauthorized modifications, malware, or other security threats.
File Level Encryption: Encryption applied to individual files, columns or database fields rather than to a whole drive. Because the protection travels with the data and decryption is bound to a specific application or user context, file-level encryption keeps working where full-disk encryption stops: an authenticated user or a compromised process on the host does not automatically obtain the plaintext. This is why PCI DSS treats file, column and field-level encryption as a primary way of rendering a stored primary account number unreadable, while placing restrictions on disk-level encryption used for the same purpose.
File Transfer Protocol (FTP): A standard network protocol used for transferring files between a client and server over a TCP/IP-based network, such as the internet. Secure alternatives like FTPS or SFTP are recommended to ensure data privacy and integrity.
FIPS (Federal Information Processing Standards): A set of standards and guidelines for the security of non-classified information systems used by the United States federal government, including encryption algorithms and key management practices.
Firewall Rule: A configuration setting within a firewall that defines the criteria for allowing or blocking network traffic based on factors such as source, destination, port, or protocol.
Firmware: Software that is embedded within a hardware device, such as a router or payment terminal, to provide low-level control and management of the device's functions and operations.
First-Party Fraud: Fraud committed by the account holder, often involving the use of their own payment card or account, with the intention of defrauding the issuing bank or merchant.
FPE (Format Preserving Encryption): An encryption method that maintains the original format of the plaintext data after it has been encrypted, enabling it to be processed or stored in systems that require specific formats without the need for decryption.
Fraud Detection: The process of monitoring and analyzing transactions, events, or activities to identify and prevent fraudulent activities, such as unauthorized charges or account takeovers.
Full-Disk Encryption (FDE): Encryption of an entire storage drive, including the operating system, applications and data, so the contents are unreadable without the decryption key. FDE protects against physical loss or theft of a device and little else: once the system has booted and a user has authenticated, the data is transparently decrypted for anything running on that system. PCI DSS therefore restricts disk-level encryption as a means of rendering a stored primary account number unreadable. It is permitted on removable media, but on non-removable storage the PAN must also be rendered unreadable by another mechanism meeting Requirement 3.5.1, because logical access by an authenticated user or a compromised process defeats it entirely.
Function Level Access Control: A security mechanism that restricts access to specific functions or features within a system or application based on the user's role or privileges.
Future-Dated Requirement: A requirement published in PCI DSS v4.0 but marked as a best practice until 31 March 2025, giving organizations time to plan and budget for it before it was assessed. Future-dated requirements were not tested for compliance before that date. All of them are now in force: since 31 March 2025 every v4.x requirement is mandatory and assessed like any other. The label still appears in v4.0 documents and older guidance, so treat it as historical context rather than a live exemption.
Fuzz Testing: A type of software testing that involves inputting random, malformed, or unexpected data into a system or application to discover potential vulnerabilities, crashes, or other issues.

G

Gap Analysis: A process used to identify and assess the differences between an organization's current state and a desired or required state, such as compliance with a security standard or best practice.
Gateway: A network device that acts as an intermediary between different networks, facilitating communication and data transfer while enforcing security policies and access controls.
GDPR (General Data Protection Regulation): A European Union regulation that governs the protection and processing of personal data, requiring organizations to implement appropriate security measures and obtain consent from individuals before collecting, storing, or processing their data.
Geofencing: A location-based security mechanism that establishes a virtual boundary around a specific geographical area, triggering actions or alerts when a device enters or leaves the defined area.
Geolocation: The process of identifying the physical location of a device or user based on factors such as IP address, GPS data, or other network and device attributes.
Ghost Terminal: A fraudulent payment terminal or point of sale (POS) device, often designed to resemble a legitimate device, used by criminals to capture cardholder data during transactions.
GPG (GNU Privacy Guard): An open-source implementation of the Pretty Good Privacy (PGP) encryption standard, used for securing email communication, digital signatures, and other sensitive data.
Granular Access Control: A security model that provides fine-grained control over user access to specific resources, functions, or data within a system or application, based on criteria such as user roles, privileges, or attributes.
GRC (Governance, Risk, and Compliance): A management approach that encompasses the processes, policies, and tools used by organizations to ensure adherence to legal, regulatory, and industry requirements, as well as to manage and mitigate risks and support effective decision-making.
Greylisting: An anti-spam technique that temporarily rejects incoming emails from unknown or suspicious senders, requiring them to resend the message after a certain period, with the assumption that legitimate senders will retry while spammers will not.
Group Policy: A Microsoft Windows feature that enables administrators to centrally manage and enforce configurations, security settings, and other policies for users and computers within an Active Directory domain.
GSM (Global System for Mobile Communications): A widely used mobile communication standard that provides voice, data, and messaging services, including features such as encryption and authentication to protect against eavesdropping and unauthorized access.
Guard: In the context of information security, a guard is a security mechanism that enforces access control policies between different security domains or network segments, preventing unauthorized data flows or communications.
GUI (Graphical User Interface): A type of user interface that allows users to interact with a system or application through graphical elements, such as buttons, icons, and menus, rather than text-based commands.
GUID (Globally Unique Identifier): A unique, 128-bit number used to identify resources, objects, or entities across different systems, ensuring that each identifier is distinct and not reused.

H

Hardware Security Module (HSM): A specialized, tamper-resistant device used to manage and protect cryptographic keys, perform encryption and decryption operations, and ensure the secure storage and processing of sensitive data.
Hash Function: A cryptographic algorithm that takes an input (or "message") and returns a fixed-size string of bytes, typically used for verifying data integrity by creating a unique "fingerprint" or "hash value" for a given piece of data.
Hashing: The process of applying a hash function to input data, resulting in a unique hash value that can be used for data integrity checks, password storage, or other security purposes.
Heap Overflow: A type of buffer overflow vulnerability that occurs when a program writes data beyond the allocated space in memory, potentially leading to crashes, data corruption, or the execution of arbitrary code by an attacker.
Heuristic Analysis: A method of detecting malware or other threats based on behavioral patterns, characteristics, or other indicators, rather than relying on specific signatures or known attributes.
HIDS (Host-based Intrusion Detection System): A security solution that monitors individual host systems, such as servers or workstations, for suspicious activity, unauthorized changes, or potential security threats, and alerts administrators when issues are detected.
High Availability: A system design approach that aims to ensure continuous operation and minimize downtime by incorporating redundancy, fault tolerance, and other measures to protect against hardware failures, software errors, or other disruptions.
HMAC (Hashed Message Authentication Code): A specific type of message authentication code (MAC) that combines a cryptographic hash function with a secret key, used to ensure the integrity and authenticity of transmitted data.
Honeypot: A security mechanism that simulates a vulnerable system or network resource, designed to attract and detect attackers or intruders, and gather information about their techniques and objectives.
Hot Site: A fully operational, off-site facility that can be quickly activated in the event of a disaster or disruption, providing an organization with the necessary infrastructure, resources, and connectivity to maintain critical operations and services.
HTTP (Hypertext Transfer Protocol): The primary protocol used for transmitting and receiving data over the World Wide Web, which defines how web browsers and servers communicate and exchange information.
HTTP Strict Transport Security (HSTS): A security policy mechanism that enforces the use of HTTPS for all connections to a specific website, protecting against various attacks that attempt to downgrade or bypass SSL/TLS encryption.
HTTPS (Hypertext Transfer Protocol Secure): An extension of HTTP that incorporates encryption using SSL/TLS, providing secure communication and data transfer between web browsers and servers.
Hybrid Cloud: A cloud computing model that combines elements of both public and private clouds, allowing organizations to balance the flexibility, scalability, and cost benefits of public cloud services with the control and security of private cloud infrastructure.
Hypervisor: A software or hardware component that creates and manages virtual machines, enabling multiple operating systems to run simultaneously on a single physical host.

I

Identification: The process of recognizing and distinguishing a user, system, or device based on a unique identifier, such as a username, IP address, or device ID, which forms the basis for authentication and access control.
Identity and Access Management (IAM): A framework of policies, procedures, and technologies used to manage user identities, authenticate users, and enforce access controls, ensuring that only authorized individuals have access to specific resources and data.
Identity Proofing: The process of verifying a user's identity by confirming the authenticity of their personal information and credentials, such as government-issued identification documents, biometric data, or knowledge-based questions.
Incident Management: The process of identifying, analyzing, and responding to security incidents, including the containment, eradication, and recovery of affected systems, and the implementation of measures to prevent future occurrences.
Incident Response Plan: A documented plan for detecting, containing, eradicating and recovering from a security incident, covering roles and responsibilities, communication paths, escalation, evidence handling and return to normal operation. PCI DSS Requirement 12.10 sets specific expectations: personnel must be available 24 hours a day, seven days a week to respond to alerts; the plan must be reviewed and tested at least once every 12 months; and it must cover notification of the payment brands and acquirers and the engagement of a PCI Forensic Investigator where account data may have been compromised. A plan that has never been exercised does not satisfy the requirement.
Information Security: The practice of protecting the confidentiality, integrity, and availability of information from unauthorized access, disclosure, modification, or destruction, through the application of administrative, technical, and physical controls.
Information Security Management System (ISMS): A systematic approach to managing and maintaining an organization's information security, which includes the establishment of policies, procedures, risk assessments, and controls, as well as the monitoring and continuous improvement of security measures.
Ingress Filtering: A network security technique that involves filtering incoming traffic based on source IP addresses, blocking packets from unauthorized or malicious sources, and preventing certain types of attacks, such as spoofing or denial-of-service (DoS).
Injection Attack: A type of security vulnerability that occurs when an attacker is able to insert or inject malicious code or commands into an application or system, potentially leading to unauthorized access, data theft, or other adverse consequences.
Insider Threat: A potential security risk originating from individuals within an organization, such as employees, contractors, or partners, who have access to sensitive information, systems, or resources, and may intentionally or unintentionally cause harm.
Integrity: A fundamental principle of information security that ensures the accuracy and consistency of data, preventing unauthorized modification or corruption, and providing assurance that information can be relied upon for its intended purpose.
Internal Security Assessor (ISA): An employee who has completed PCI Security Standards Council training and certification, qualifying them to perform PCI DSS assessments for their own organization. An ISA can complete internal assessments and Self-Assessment Questionnaires, and some payment brands accept ISA involvement where a Qualified Security Assessor would otherwise be required. An ISA cannot assess other organizations; that requires a QSA.
Internal Vulnerability Scanning: Scanning performed from inside the network to identify vulnerabilities on system components in and connected to the cardholder data environment. PCI DSS requires it at least once every three months and after any significant change, with high-risk and critical findings resolved and rescans performed to confirm the fix. Unlike external scanning it does not require an Approved Scanning Vendor and may be run by qualified internal staff, provided they are organizationally independent of the systems being scanned. Under v4.x these scans must also be authenticated.
Internet of Things (IoT): A network of interconnected devices, such as sensors, appliances, or wearables, that communicate and exchange data over the internet, enabling various applications, services, and automation capabilities.
Intrusion Detection System (IDS): A security solution that monitors network traffic or system activity for signs of unauthorized access, malicious activity, or potential security threats, and generates alerts or notifications when suspicious events are detected.
Intrusion Prevention System (IPS): An extension of intrusion detection systems that not only detects potential threats but also takes automated actions to block or prevent malicious activity, such as dropping packets, terminating connections, or reconfiguring network devices.
Inventory Management: The process of tracking and maintaining an organization's hardware, software, and other assets, including the identification, classification, and documentation of assets, as well as the implementation of controls to ensure their proper use and protection.
Issuer: The financial institution that issues payment cards to cardholders, holds the cardholder account and carries the credit risk on it. During a transaction the issuer authorizes or declines the request routed to it by the payment brand network. The issuer is the counterpart to the acquirer, which holds the relationship with the merchant, and the two are frequently confused.

J

Jump Server: Also known as a jump host or bastion host, a jump server is a secure, intermediate server placed between a user's device and a target system or network, providing an additional layer of security and access control. It helps to mitigate the risk of unauthorized access or lateral movement within the network.

K

Key Custodian: A named individual formally assigned responsibility for a cryptographic key or key component. PCI DSS requires custodians to be identified, to acknowledge their responsibilities in writing, and to operate under split knowledge and dual control for clear-text key operations. Custodian records are a routine assessment request, and unsigned or missing acknowledgements are a common finding.
Key Encrypting Key (KEK): A cryptographic key used to encrypt other keys rather than data. Storing a data encrypting key wrapped under a KEK means the working key is never held in the clear on disk. PCI DSS requires that a key encrypting key be at least as strong as the key it protects, and that it be stored separately from it, since keeping both in the same place defeats the purpose.
Key Management: The process of managing cryptographic keys, including their generation, distribution, storage, use, and disposal. Key management is crucial in ensuring the security of encrypted data, including cardholder data in the context of PCI DSS. Proper key management practices help maintain the confidentiality and integrity of sensitive data and are required for PCI DSS compliance.
Key Rotation: The practice of periodically changing cryptographic keys used for encryption and decryption to reduce the risk of unauthorized access to sensitive data. Key rotation is an important aspect of key management and can help organizations maintain compliance with PCI DSS by ensuring the ongoing security of encrypted cardholder data.
Keylogger: A type of malicious software or hardware that captures and records users' keystrokes, typically with the intent of stealing sensitive information such as passwords, credit card numbers, or other personal data. Protecting against keyloggers is essential for maintaining the security of cardholder data and achieving PCI DSS compliance.

L

Least Privilege: The principle of granting users or systems the minimum level of access necessary to perform their tasks or functions. This approach helps reduce the risk of unauthorized access to sensitive data, such as cardholder data, and is an important concept in achieving PCI DSS compliance.
Log Management: The lifecycle around log data: collecting it from across the estate, centralising it, protecting it from alteration or deletion, retaining it for a defined period, reviewing it and disposing of it. PCI DSS requires at least 12 months of retention with the most recent three months immediately available, daily review of security-critical logs, and, under v4.x, automated mechanisms to perform that review. Centralising logs onto a separate hardened system matters because an attacker who controls a host can otherwise edit the evidence of the intrusion.
Logging: The act of recording events as they occur in a system, application or network device. Logging is the mechanism; what must be recorded, how those records are protected and how long they are kept are covered under Audit Log / Audit Trail and Log Management. PCI DSS requires logging to be enabled and active on all system components in scope, and treats the disabling or pausing of logging as itself an event that must be logged.
Logical Access Control: A method of controlling access to computer systems, applications, or data based on user credentials, such as usernames, passwords, or access tokens. Logical access control is an important aspect of securing cardholder data and maintaining PCI DSS compliance.

M

Magnetic Stripe Data: The full contents of a payment card magnetic stripe, also called full track data or Track 1 and Track 2 data. Alongside the primary account number, cardholder name and expiration date, the tracks carry the CVV1 (CAV1) value and discretionary data. Full track data is Sensitive Authentication Data and must never be stored after authorization under any circumstances, including in application logs, transaction histories, crash dumps or debugging output. Retained track data is one of the most frequent findings in post-breach forensic investigations.
Malware: Malicious software designed to infiltrate, damage, or compromise a computer system, network, or device without the user's consent. Protecting against malware is essential for maintaining the security of cardholder data and achieving PCI DSS compliance.
Masking: The process of concealing or obfuscating sensitive information, such as credit card numbers, by replacing it with other characters or symbols. Masking is often used to display only a portion of cardholder data, reducing the risk of unauthorized access and helping organizations maintain PCI DSS compliance.
Merchant: A business or organization that accepts payment cards as a form of payment for goods or services. Merchants are required to comply with PCI DSS to ensure the security of cardholder data.
Merchant Level: The tier a payment brand assigns a merchant, which determines how that merchant must validate PCI DSS compliance. Levels are based mainly on annual transaction volume per brand. Broadly: Level 1 covers the largest merchants, typically above six million transactions a year, and requires an annual Report on Compliance; Levels 2 to 4 cover progressively smaller volumes and generally allow a Self-Assessment Questionnaire. Any merchant that suffers a breach can be moved to Level 1 regardless of volume. Levels are set and enforced by each payment brand rather than by the PCI Security Standards Council, so thresholds and validation rules differ between brands, and an acquirer may impose stricter terms than the brand minimum.
Message Authentication Code (MAC): A short piece of information used to authenticate a message and confirm its integrity. MACs are commonly used in conjunction with encryption to ensure the security of sensitive data, such as cardholder data, during transmission.
Monitoring: The process of continuously observing and analyzing the operation of computer systems, networks, or applications to detect potential security issues or anomalies. Monitoring is an essential aspect of maintaining the security of cardholder data and achieving PCI DSS compliance.
MOTO (Mail Order/Telephone Order): A type of card-not-present transaction where a customer provides their payment card information to a merchant via mail or telephone. MOTO transactions are subject to PCI DSS requirements to ensure the security of cardholder data during processing, storage, and transmission.
MPoC (Mobile Payments on COTS): A PCI Security Standards Council standard covering payment acceptance on ordinary mobile devices, including contactless acceptance and PIN entry on the same device. MPoC builds on the earlier SPoC and CPoC standards and is intended to consolidate them, replacing their fixed solution shapes with a modular, outcome-based set of requirements that suits a wider range of designs.
Multi-factor Authentication (MFA): Authentication requiring evidence from at least two of three independent categories: something the user knows, such as a password; something the user has, such as a token or registered device; and something the user is, such as a biometric. The categories must differ. Two passwords, or a password and a security question, are not multi-factor, because both come from the same category. PCI DSS v4.x requires MFA for all access into the cardholder data environment and for all remote network access, and requires the factors to be independent, so that compromising one does not yield the other. Requirement 8.5.1 further requires MFA systems to resist replay attacks.
Multi-Tenant Service Provider: A service provider that delivers shared infrastructure or services to multiple customers from a common environment, such as a cloud or hosting platform. PCI DSS Appendix A1 places additional requirements on these providers: logically separating each customer environment, restricting every customer to its own environment, and giving customers access to their own logs and the ability to perform their own vulnerability scanning and penetration testing. In v4.x this appendix was broadened and renamed from its earlier shared hosting provider framing.

N

NAT (Network Address Translation): A technique used to map one IP address space to another, often used to enable private IP addresses to communicate over the public internet. NAT can play a role in network security by hiding internal IP addresses and is sometimes used within the context of PCI DSS to protect cardholder data environments.
Network: A group of interconnected devices, such as computers, servers, and switches, that facilitate communication and data exchange. Ensuring the security of networks, particularly those within the cardholder data environment, is critical for maintaining PCI DSS compliance.
Network Access Control (NAC): A method of managing and controlling access to a network based on user or device identity, role, or other attributes. NAC is an important aspect of securing cardholder data and maintaining PCI DSS compliance by preventing unauthorized access to sensitive systems and data.
Network Security Control (NSC): The PCI DSS v4.x term for any technology that enforces network policy between segments, replacing the v3.2.1 wording "firewalls and routers". It covers traditional firewalls but also cloud security groups, virtual network appliances and container network policy, which is the point of the change: Requirement 1 applies to whatever enforces the policy, not only to a physical appliance.
Network Segmentation: Dividing a network into isolated segments using firewalls, routing controls or equivalent, so traffic between them is controlled rather than unrestricted. In PCI DSS, segmentation is the main lever for reducing scope: it separates the cardholder data environment from the rest of the network so unrelated systems fall outside the assessment. It is not itself a requirement, and an organization may run a flat network if it chooses, but then every system on that network is in scope. Where segmentation is relied on to reduce scope, it must be proven by segmentation penetration testing, and a failed test collapses the scope reduction with it.
Non-console Access: Remote access to a computer system or network device without using a directly connected physical console. Non-console access typically involves connecting to a system via a network or the internet, and proper security measures should be in place to protect cardholder data and maintain PCI DSS compliance during non-console access.
Non-Consumer User: A user who is not a consumer or end customer, typically referring to employees, contractors, or other individuals with access to a company's systems, networks, or data. Non-consumer users may have access to sensitive cardholder data and should be subject to PCI DSS controls to ensure the security of that data.
Non-repudiation: The assurance that a party cannot deny the authenticity of their actions or the validity of a message or transaction. In the context of PCI DSS, non-repudiation can be important for proving the legitimacy of transactions and ensuring the accountability of parties involved in processing cardholder data.
Nonce: A unique, one-time value used in cryptographic operations, such as encryption or authentication, to prevent replay attacks. Nonce values can be used to ensure the freshness of a message or transaction and are sometimes employed as part of a secure communication protocol within the context of PCI DSS and information security.
NTP (Network Time Protocol): A protocol used to synchronize the clocks of computers and devices over a network. Accurate timekeeping is important for activities such as logging and monitoring, which are required by PCI DSS to ensure the security and integrity of cardholder data environments.

O

OAuth: An open standard for secure access delegation, commonly used as a way for users to grant access to their information on one site to another site without sharing their credentials. In the context of PCI DSS, OAuth can be used for secure authentication and authorization between systems that handle cardholder data.
Obfuscation: The process of making data or code difficult to understand or interpret, often used as a security measure to protect sensitive information. Obfuscation can be applied to cardholder data to help protect it from unauthorized access and achieve PCI DSS compliance.
One-time Password (OTP): A unique, temporary password generated for a single use or session, often used as part of multi-factor authentication to enhance security. OTPs can be used to protect cardholder data and access to sensitive systems, as required by PCI DSS.
One-way Hash: A cryptographic function that takes an input and produces a fixed-size output, often referred to as a hash, which is unique for each unique input. One-way hashes are designed to be irreversible, making it difficult to determine the original input from the hash value. In the context of PCI DSS, one-way hashing can be used to protect stored cardholder data by rendering it unreadable.
Open-source Software: Software whose source code is made available to the public, allowing users to view, modify, and distribute the software. While open-source software can offer cost and flexibility benefits, it is important to ensure that any open-source software used within the cardholder data environment is secure and compliant with PCI DSS requirements.
Operating System: The software that manages a computer's hardware and software resources, providing a platform for applications to run. Ensuring the security and proper configuration of operating systems is crucial for maintaining the security of cardholder data and achieving PCI DSS compliance.
Out-of-band Authentication: A method of authentication that uses a separate, independent channel or mechanism to verify a user's identity, such as a phone call or text message. Out-of-band authentication can be used as part of multi-factor authentication to enhance security and help maintain PCI DSS compliance.
Outsourcing: The practice of contracting with a third-party organization to provide services or perform tasks that would otherwise be done in-house. When outsourcing services related to cardholder data or the cardholder data environment, it is crucial to ensure that third-party providers are PCI DSS compliant and have adequate security measures in place.

P

P2PE (Point-to-Point Encryption): A technology that encrypts cardholder data from the point of capture at the merchant until it reaches the payment processor, ensuring that the data remains unreadable even if intercepted. P2PE can help merchants achieve PCI DSS compliance by reducing the scope of their cardholder data environment.
PA-DSS (Payment Application Data Security Standard): A retired standard that set security requirements for commercially sold payment applications handling cardholder data. PA-DSS closed on 28 October 2022 and was replaced by the PCI Software Security Framework, made up of the Secure Software Standard and the Secure Software Lifecycle (Secure SLC) Standard. Applications previously validated under PA-DSS moved to an acceptable-only-for-pre-existing-deployments list, and all new validations are performed under the Software Security Framework.
PAN (Primary Account Number): The payment card number, typically 13 to 19 digits, that identifies the issuer and the specific cardholder account. The PAN is the defining element of Cardholder Data: wherever it is stored, processed or transmitted, PCI DSS applies. It is Cardholder Data rather than Sensitive Authentication Data, so it may be stored where there is a documented business need, provided it is rendered unreadable by truncation, one-way keyed hashing, tokenization or strong cryptography. When displayed, the PAN must be masked so that no more than the first six and last four digits are visible, unless a user has a documented business need to see more.
Password: A secret combination of characters used to authenticate a user's identity and grant access to a system or account. PCI DSS mandates strong password policies to help protect cardholder data and maintain the security of the cardholder data environment.
Patch: A software update that addresses security vulnerabilities, bugs, or other issues. Regularly applying security patches is essential for maintaining PCI DSS compliance and ensuring the security of cardholder data.
Payment Brand: One of the card networks that operates a payment system and sets the rules merchants and service providers must follow: Visa, Mastercard, American Express, Discover and JCB, the five founding members of the PCI Security Standards Council. The distinction matters in practice. The council writes and maintains PCI DSS but does not enforce it. Each payment brand runs its own compliance validation program, sets merchant and service provider levels, decides who must submit what, and levies fines through acquirers. Requirements and thresholds therefore differ between brands.
Payment Gateway: A service that passes transaction data from a merchant e-commerce site or point-of-sale system through to a payment processor. Gateways often provide hosted payment pages, iframes or tokenization, which can substantially reduce a merchant cardholder data environment and change which Self-Assessment Questionnaire applies. Using a gateway does not remove the obligation to comply; it changes the scope of what must be assessed.
Payment Page Script: Any script that loads and executes in the consumer's browser as part of a payment page, including analytics, tag managers, chat widgets, fonts and third-party libraries as well as the merchant's own code. PCI DSS Requirement 6.4.3 requires each such script to be authorized, its integrity assured, and an inventory maintained with a written business justification for every entry. The requirement addresses client-side skimming, where a compromised or malicious third-party script harvests card data directly from the page. This was future-dated at publication and became mandatory on 31 March 2025.
Payment Processor: The entity that handles the mechanics of a card transaction on behalf of an acquirer, routing authorization requests to the payment brand networks and managing clearing and settlement. Processors store, process and transmit account data, so they are service providers under PCI DSS and must validate their own compliance.
PCI DSS (Payment Card Industry Data Security Standards): The Payment Card Industry Data Security Standard, a set of technical and operational requirements applying to every organization that stores, processes or transmits account data, and to any system that could affect the security of that data. It is maintained by the PCI Security Standards Council on behalf of the major payment brands. The current version is v4.0.1, published in June 2024. Every v4.x requirement, including those originally published as future-dated, became mandatory on 31 March 2025.
PCI Forensic Investigator (PFI): A company qualified by the PCI Security Standards Council to investigate suspected payment card data compromises. After a breach, a payment brand or acquirer typically requires the affected entity to engage a PFI, which determines how the compromise occurred, what account data was exposed, and whether the entity was compliant at the time. The resulting report goes to the payment brands and the acquirer, not only to the entity that commissioned it.
PCI SSC (Payment Card Industry Security Standards Council): A global forum that was launched in 2006 to manage the ongoing evolution of the Payment Card Industry (PCI) security standards with focus on improving payment security.
Penetration Testing: A security testing process that simulates real-world attacks on a system or network to identify vulnerabilities and weaknesses. PCI DSS requires regular penetration testing of the cardholder data environment to ensure its security.
Personal Identification Number (PIN): A unique, secret numeric code used to authenticate a user's identity, often in conjunction with a payment card. PINs are considered sensitive authentication data under PCI DSS and must be protected accordingly.
Phishing: A type of social engineering attack where an attacker attempts to deceive users into revealing sensitive information, such as passwords or credit card numbers, by masquerading as a trustworthy entity. Phishing attacks can pose a threat to cardholder data and must be addressed as part of a comprehensive PCI DSS security program.
Phishing-Resistant Authentication: Authentication that cannot be defeated by tricking a user into handing over a credential or approving a prompt, because the factor is cryptographically bound to the legitimate site or device. FIDO2 security keys, passkeys and certificate-based authentication are phishing-resistant. SMS codes, one-time passwords and push approvals are not, because a user can be induced to relay or approve them. PCI DSS Requirement 8.5.1 requires multi-factor authentication systems to resist replay attacks, and PCI SSC guidance points to phishing-resistant factors as the stronger option.
Physical Security: The protection of an organization's facilities, assets, and personnel from unauthorized access, damage, or theft. Physical security measures, such as access controls and surveillance systems, are an important part of PCI DSS compliance to ensure the security of cardholder data.
PIN Block: The encrypted block that carries a personal identification number between a PIN entry device and the system that verifies it. A PIN is never transmitted or stored in the clear: it is combined with account data, formatted into a block and encrypted, typically inside a hardware security module or a PTS-approved device. PIN blocks are Sensitive Authentication Data and must not be retained after authorization.
PKI (Public Key Infrastructure): A system that manages the creation, distribution, and revocation of public key certificates for use in public key cryptography. PKI can be used to secure communications and authenticate users within the cardholder data environment, supporting PCI DSS compliance.
Point of Interaction (POI): The initial point where cardholder data is read from a card, typically a payment terminal.
Point of Sale (POS): The physical location or system where a customer makes a payment for goods or services. Ensuring the security of POS systems and the cardholder data they process is critical for maintaining PCI DSS compliance.
Port Scanning: A method of probing a network or system to identify open ports and potentially vulnerable services. Regular port scanning is part of PCI DSS requirements to ensure the security of the cardholder data environment.
Prioritized Approach: A supporting tool published by the PCI Security Standards Council that sorts PCI DSS requirements into six milestones, ordered so the controls that most reduce breach risk come first, such as removing stored sensitive authentication data before tackling later refinements. It helps an organization sequence a remediation programme and show measurable progress to an acquirer. It is a planning aid only: working through the milestones does not confer partial compliance, and full compliance is still required.
Privacy: The protection of an individual's personal information from unauthorized access, use, or disclosure. Privacy is an important consideration for organizations that handle cardholder data, and PCI DSS requirements help support privacy by mandating the protection of sensitive information.
Privilege Escalation: The process of exploiting a vulnerability or misconfiguration to gain elevated access or privileges on a system or network. Preventing privilege escalation is an important part of PCI DSS compliance to protect cardholder data from unauthorized access.
Pseudonymization: The process of replacing sensitive data with non-sensitive substitutes or pseudonyms, in a way that makes it difficult to re-identify the original data. Pseudonymization can be used as a technique to protect cardholder data and reduce the scope of PCI DSS compliance requirements.
PTS (PIN Transaction Security): A set of modular evaluation requirements managed by PCI Security Standards Council, for PIN acceptance POI terminals.
Public Key Cryptography: See Asymmetric Encryption under A for the full definition.

Q

QIR (Qualified Integrator and Reseller): A company trained and qualified by the PCI Security Standards Council to install and maintain payment systems for merchants. QIR training targets the configuration mistakes that most often cause card data breaches at smaller merchants: vendor default credentials left in place, insecure remote access, unnecessary services left enabled, and payment applications deployed outside their validated configuration. Qualification is held at company level through named trained employees and must be renewed each year. The program exists for merchants who depend on an integrator or reseller rather than running a security function of their own, and some acquirers require a QIR for payment system installations.
QR Code: A two-dimensional barcode that can be scanned and read by smartphones or other devices equipped with a QR code reader. QR codes can be used in payment processing and other applications, but organizations using QR codes should ensure that they are used securely and in compliance with PCI DSS requirements.
QSA (Qualified Security Assessor): A professional certified by the Payment Card Industry Security Standards Council (PCI SSC) to assess an organization's compliance with PCI DSS requirements. QSAs play a crucial role in ensuring the security of cardholder data by verifying that companies have implemented the necessary controls and processes.
Quality of Service (QoS): A measure of the performance of a network or system in terms of throughput, delay, and other factors. In the context of PCI DSS, maintaining an appropriate level of QoS is important to ensure the availability and reliability of cardholder data and the systems that process it.
Quarantine: The process of isolating potentially malicious or compromised systems, files, or users from a network or system to prevent further damage or data loss. Implementing quarantine measures can be a key part of incident response and maintaining PCI DSS compliance in the face of security threats.
Query: A request for information or data from a database, system, or network. In the context of PCI DSS, organizations should ensure that queries related to cardholder data are appropriately controlled and monitored to prevent unauthorized access or data leakage.

R

Ransomware: A type of malicious software that encrypts a victim's files or data, demanding a ransom to restore access. Organizations must implement strong security measures, including regular backups and malware protection, to prevent ransomware attacks and maintain PCI DSS compliance.
RBAC (Role-Based Access Control): A method of managing user access to resources and functions based on their roles or job responsibilities. RBAC is a recommended practice in PCI DSS to ensure that users have the minimum necessary access to cardholder data and related systems.
Real-time Monitoring: The continuous observation and analysis of a system or network to detect and respond to security events as they occur. Real-time monitoring is an important aspect of PCI DSS compliance, as it helps organizations identify and address security threats promptly.
Red Team: A group of security professionals that simulate real-world attacks on an organization's systems and networks to identify vulnerabilities and weaknesses. Red team exercises can support PCI DSS compliance efforts by providing valuable insights into the security of the cardholder data environment.
Remote Access: The ability to access a computer, network, or system from a location other than where the resource is physically located. PCI DSS requires organizations to implement strong security controls, such as multi-factor authentication, to secure remote access to cardholder data and related systems.
Replay Attack: A type of cyberattack in which an attacker intercepts and retransmits a valid message or session to gain unauthorized access or manipulate the system. Organizations must implement appropriate security measures, such as encryption and secure session management, to prevent replay attacks and maintain PCI DSS compliance.
Residual Risk: The remaining risk after an organization has implemented security controls and measures to mitigate identified risks. Understanding and managing residual risk is important for maintaining PCI DSS compliance and ensuring the ongoing security of cardholder data.
Response Plan: See Incident Response Plan under I for the full definition.
Risk: The potential for loss or damage due to a threat or vulnerability. PCI DSS requires organizations to conduct regular risk assessments to identify and mitigate risks related to cardholder data and related systems.
Risk Assessment: A systematic process of evaluating the potential risks that may be involved in an organization's activities and operations. PCI DSS requires organizations to conduct regular risk assessments to identify and address risks to cardholder data and related systems.
Risk Management: The process of identifying, assessing, and prioritizing risks, as well as implementing appropriate controls and measures to mitigate them. Risk management is a key component of PCI DSS compliance and ensuring the security of cardholder data.
Risk Mitigation: The process of implementing controls and measures to reduce the likelihood or impact of identified risks. Risk mitigation is an important aspect of PCI DSS compliance and helps organizations protect cardholder data and maintain the security of their cardholder data environment.
Risk Ranking: The severity an organization assigns to a vulnerability in its own environment, which determines how quickly the vulnerability must be fixed. PCI DSS requires vulnerabilities to be ranked, with those ranked critical or high remediated on a defined and short timeline and the remainder addressed according to their ranking. A CVSS score is an input, not the answer: the ranking must account for what the affected system does, where it sits relative to the cardholder data environment, and what other protections are in place. The method must be documented and applied consistently.
RoC (Report on Compliance): Report documenting detailed results from an entity's PCI DSS assessment.
Rootkit: A type of malicious software that hides its presence on a system, often by modifying operating system components or processes. Organizations must implement strong malware protection measures to detect and remove rootkits and maintain PCI DSS compliance.
Router: A network device that forwards data packets between computer networks, helping to route traffic between different systems and networks. Routers play a crucial role in the security of cardholder data environments and must be properly configured and maintained to ensure PCI DSS compliance.
RSA: A widely-used public key cryptosystem that enables secure data transmission and digital signatures. RSA can be used to protect cardholder data and support PCI DSS compliance by ensuring the confidentiality, integrity, and authenticity of data and communications.
Rule-based Access Control: An access control model that manages user access to resources and functions based on specific rules or conditions. Rule-based access control can be used in combination with role-based access control (RBAC) to ensure that users have the minimum necessary access to cardholder data and related systems, as required by PCI DSS.
Runtime Application Self-Protection (RASP): A security technology that monitors application execution and detects and prevents real-time attacks by analyzing application behavior. Implementing RASP can help organizations strengthen the security of their cardholder data environment and support PCI DSS compliance efforts.

S

SaaS (Software as a Service): A software licensing and delivery model in which applications are provided over the internet, rather than installed locally on individual devices. When using SaaS solutions that involve cardholder data, organizations must ensure that the provider meets PCI DSS requirements.
Safe Harbor: A set of data protection principles that help organizations transfer personal data across international borders while maintaining compliance with privacy laws. PCI DSS does not specifically address safe harbor, but organizations must ensure that they comply with all applicable data protection regulations when handling cardholder data.
Salt: Random data that is combined with a password or other sensitive information before being hashed, in order to increase the complexity and security of the hash. Salting is a recommended practice for protecting stored passwords and maintaining PCI DSS compliance.
SAQ (Self Assessment Questionnaire): A validation document an eligible organization completes itself, rather than engaging an assessor, to record how it meets PCI DSS. There are nine questionnaires, each scoped to a specific way of accepting payments: A, A-EP, B, B-IP, C, C-VT, P2PE, SPoC and D, with D published in separate merchant and service provider versions. Each has strict eligibility criteria, and selecting the wrong one is a common and consequential error, because it can leave whole categories of requirement unassessed. Eligibility to self-assess at all is set by the payment brands and the acquirer, based on merchant or service provider level.
SAQ A: The Self-Assessment Questionnaire for card-not-present merchants, e-commerce or MOTO, that have outsourced all account data functions to PCI DSS compliant third parties and neither store, process nor transmit account data on their own systems. It is the shortest SAQ. Eligibility is narrow and frequently claimed in error: a merchant whose own web page delivers or controls anything involved in taking payment generally belongs on SAQ A-EP instead. Eligibility criteria and payment page requirements were revised in v4.x, so a merchant that qualified under v3.2.1 should re-check.
SAQ A-EP: The Self-Assessment Questionnaire for e-commerce merchants that outsource payment processing to a PCI DSS compliant third party but whose own website can affect the security of the transaction, for example by delivering the page that loads the payment form, by direct post, or by controlling the script that renders an embedded form. The merchant does not store account data electronically. SAQ A-EP is substantially longer than SAQ A because the merchant website is in scope, and it is where most modern e-commerce integrations actually land.
SAQ B: The Self-Assessment Questionnaire for merchants that take payments only through imprint machines or standalone dial-out terminals with no internet connection, and that store no account data electronically. Paper records may still be held, so physical security and retention requirements continue to apply.
SAQ B-IP: The Self-Assessment Questionnaire for merchants using standalone, PTS-approved payment terminals with an IP connection to the processor, storing no account data electronically. The IP connectivity is what separates it from SAQ B and brings network security requirements into scope.
SAQ C: The Self-Assessment Questionnaire for merchants with a payment application system connected to the internet, where the application is not on the same system as any other system holding account data, and no account data is stored electronically. It is one of the longer merchant questionnaires because the payment application and its network are fully in scope.
SAQ C-VT: The Self-Assessment Questionnaire for merchants that key transactions one at a time into a web-based virtual terminal supplied by a PCI DSS compliant third party, using a device isolated from other systems and storing no account data electronically. Batch processing, or connecting the terminal into a wider network, breaks eligibility.
SAQ D: The catch-all Self-Assessment Questionnaire, published in two versions. SAQ D for Merchants applies to any merchant eligible to self-assess that does not meet the criteria for a more specific questionnaire, including any merchant that stores account data electronically. SAQ D for Service Providers applies to service providers eligible to self-assess. Both cover essentially every PCI DSS requirement, making SAQ D far larger than the others and close in scope to a Report on Compliance.
SAQ P2PE: The Self-Assessment Questionnaire for merchants using only hardware payment terminals that form part of a PCI SSC listed Point-to-Point Encryption solution, with no account data stored electronically. It is the shortest of all the questionnaires, because a validated P2PE solution removes most of the cardholder data environment from scope. The solution must appear on the council listing; encryption alone, however strong, does not qualify.
SAQ SPoC: The Self-Assessment Questionnaire for merchants accepting payments through a commercial off-the-shelf mobile device paired with a secure card reader as part of a PCI SSC listed Software-based PIN entry on COTS solution, storing no account data electronically.
Scoping: The process of determining the systems, networks, and components that are in scope for PCI DSS compliance. Scoping is an essential step in ensuring that an organization has properly implemented the necessary security controls to protect cardholder data.
SDLC (Software Development Life Cycle): The process of planning, designing, building, testing, and maintaining software applications. Organizations must follow secure SDLC practices when developing applications that process, store, or transmit cardholder data in order to maintain PCI DSS compliance.
Secure Coding: The practice of developing software applications in a way that reduces the likelihood of security vulnerabilities and risks. Secure coding is essential for maintaining PCI DSS compliance and ensuring the security of cardholder data.
Secure SLC (Secure Software Lifecycle Standard): The half of the PCI Software Security Framework that assesses how a vendor builds software rather than the finished product: threat modelling, secure design, code review, vulnerability management and change control across the development lifecycle. A vendor with Secure SLC qualification can self-attest to certain low-impact changes without a full reassessment of the product, which is what makes frequent release cycles workable under the framework.
Secure Socket Layer (SSL): An obsolete cryptographic protocol for securing network communications, superseded by Transport Layer Security (TLS). Every version of SSL contains known weaknesses that cannot be fixed by configuration. PCI DSS has not accepted SSL or early TLS as strong cryptography since 30 June 2018, and they may not be used to protect account data in transit or relied on as a security control. TLS 1.2 or higher is required. The name survives in product and library names such as OpenSSL and in the phrase SSL certificate, both of which mean TLS in practice.
Security Event: An occurrence or activity that indicates a potential threat to the security of an organization's information systems or data. Organizations must implement monitoring and alerting mechanisms to detect security events and maintain PCI DSS compliance.
Security Information and Event Management (SIEM): A type of software solution that collects, analyzes, and correlates security event data from various sources, helping organizations detect and respond to security incidents. Implementing a SIEM solution can support PCI DSS compliance efforts by providing visibility into the security of the cardholder data environment.
Security Policy: A set of documented rules and guidelines that define an organization's approach to information security and the protection of sensitive data, such as cardholder data. PCI DSS requires organizations to establish, maintain, and enforce a comprehensive security policy.
Segmentation: See Network Segmentation under N for the full definition.
Segmentation Penetration Testing: Testing performed specifically to prove that the controls isolating the cardholder data environment from the rest of the network actually hold, as distinct from a general penetration test of the environment. PCI DSS requires it at least once every 12 months and after any change to segmentation controls or methods, with service providers required to test at least once every six months. If segmentation is being relied on to reduce scope and this testing fails, the scope reduction fails with it.
Sensitive Authentication Data (SAD): Data used to authenticate a cardholder or transaction, such as full magnetic stripe data, card verification codes (CVC), and personal identification numbers (PIN). PCI DSS prohibits the storage of sensitive authentication data after transaction authorization.
Service Code: A three or four-digit value encoded on the magnetic stripe or chip of a payment card that tells the terminal how the card may be used, such as whether it is valid internationally, whether a PIN is required, and whether the chip must be used in preference to the stripe. The service code is one of the four elements PCI DSS classifies as Cardholder Data, alongside the primary account number, cardholder name and expiration date, so it must be protected wherever it is stored. Storing it as a discrete data element is permitted; retaining the full track data it was read from is not.
Service Provider: A company that provides services to merchants or other entities that involve the processing, storage, or transmission of cardholder data. Service providers must comply with PCI DSS requirements and are subject to validation by qualified security assessors (QSAs).
Service Provider Level: The tier a payment brand assigns a service provider, determining how it must validate compliance. Level 1 service providers, typically those handling more than 300,000 transactions a year, require an annual onsite assessment producing a Report on Compliance. Level 2 service providers may generally self-assess using SAQ D for Service Providers. As with merchant levels, thresholds are set by each payment brand rather than by the PCI Security Standards Council. PCI DSS also contains requirements that apply only to service providers, independent of level.
Shared Hosting Provider: A provider that hosts multiple customer environments on shared infrastructure. Earlier versions of PCI DSS addressed these providers specifically in Appendix A1; v4.x broadened that appendix to cover multi-tenant service providers generally, reflecting the shift from traditional shared web hosting to cloud platforms. The underlying obligation is unchanged: one customer must not be able to reach another customer environment or data.
Significant Change: A change to an environment substantial enough to require PCI DSS activities to be repeated. The standard deliberately avoids fixing a single definition, leaving each organization to define it for its own environment and document the reasoning. It commonly covers new or replaced hardware and software in the cardholder data environment, changes to network topology or firewall rules, changes to system components, and anything that alters scope. When one occurs, internal and external vulnerability scans must be repeated, penetration testing scope reconsidered, and applicable requirements confirmed as still in place. Service providers must also review scope after a significant change.
Skimming: Capturing card data by tampering with the physical point of acceptance, using a device fitted over or inside a terminal, ATM or fuel pump to read the magnetic stripe, and often a pinhole camera or overlay keypad to capture the PIN. PCI DSS requires point-of-interaction devices to be inventoried, inspected periodically for tampering and substitution, and staff to be trained to recognise it.
Social Engineering: A type of attack in which an attacker manipulates people into revealing sensitive information or performing actions that compromise security. Organizations must implement security awareness.
Software Security Framework (SSF): The PCI Security Standards Council framework that replaced PA-DSS on 28 October 2022. It comprises two standards: the Secure Software Standard, which validates a payment software product, and the Secure Software Lifecycle Standard, which validates the vendor development process. The framework is designed to accommodate modern development practices such as continuous delivery, which PA-DSS, built around discrete versioned releases, handled poorly.
Split Knowledge: A control in which a cryptographic key is divided into components and no single person holds enough of them to reconstruct the key. Each custodian knows only their own component. PCI DSS requires split knowledge together with dual control for manual clear-text key management operations, so that no individual can obtain or use a key alone. Split knowledge answers who knows what; dual control answers who must be present to act.
SPoC (Software-based PIN Entry on COTS): A PCI Security Standards Council standard for solutions that accept a PIN on an ordinary commercial off-the-shelf device, such as a phone or tablet, paired with a separate secure card reader that handles the card data. The security model depends on that separation, and only solutions listed by the council qualify.
Strong Cryptography: Cryptography based on algorithms and key lengths that are industry-tested and accepted, with effective key management behind them. PCI DSS treats a minimum of 112 bits of effective key strength as the threshold, which in practice means AES-128 or above, RSA-2048 or above, and TLS 1.2 or higher for data in transit. The term covers more than algorithm choice: an approved algorithm used with weak keys, a poor mode of operation or careless key storage is not strong cryptography. SSL, early TLS, DES and SHA-1 for signatures no longer qualify.
System Component: Any network device, server, computing device, virtual component, cloud component or piece of software that sits within the cardholder data environment or is connected to it. The term matters because PCI DSS requirements apply per system component, so what counts as one directly determines the size and cost of an assessment. Virtual machines, containers, hypervisors, cloud services and serverless functions are all system components, and the inventory of them required by Requirement 12.5.1 is the foundation of accurate scoping.

T

Targeted Risk Analysis (TRA): A documented risk analysis that PCI DSS v4.x requires in two situations. Under Requirement 12.3.1, an organization performs one for each requirement that lets it set its own frequency for an activity, justifying the interval it chooses. Under Requirement 12.3.2, it performs one for each requirement met through the Customized Approach. Every targeted risk analysis must be reviewed at least once every 12 months, and PCI DSS Appendix E provides sample templates. It is narrow by design, addressing a single requirement rather than serving as a general enterprise risk assessment.
Third-Party Service Provider: An organization that provides services to another organization, which may involve the processing, storage, or transmission of cardholder data. Abbreviated TPSP. Third-party service providers must comply with PCI DSS requirements and may be subject to validation by qualified security assessors (QSAs). Requirement 12.8 governs how an entity manages them, including a written acknowledgement of which PCI DSS responsibilities the provider accepts.
Threat Modeling: A structured approach to identifying, quantifying, and addressing security threats and vulnerabilities in an organization's information systems. Threat modeling can help organizations prioritize security efforts and maintain PCI DSS compliance.
Three-Domain Secure (3-D Secure): An authentication protocol designed to enhance the security of online credit and debit card transactions by verifying the cardholder's identity at the time of purchase. Implementing 3-D Secure can help merchants reduce fraud and support PCI DSS compliance.
Token Service Provider (TSP): An entity that generates, issues and manages payment tokens, and maintains the mapping between a token and the underlying primary account number. Because the token vault holds that mapping, a TSP is a high-value target and is covered by dedicated PCI Security Standards Council security requirements in addition to PCI DSS.
Tokenization: A process that replaces sensitive data, such as cardholder data, with unique non-sensitive identifiers called tokens. Tokenization can help organizations reduce the risk of data breaches and maintain PCI DSS compliance by minimizing the amount of sensitive data stored in their systems.
Track Data: The data encoded in the tracks of a payment card magnetic stripe, or the equivalent data held on a chip. Track 1 carries the primary account number, cardholder name, expiration date, service code and discretionary data; Track 2 carries a shorter set without the name. Both include a card validation value, CVV1 or CAV1. Track data is Sensitive Authentication Data in full and must never be stored after authorization, in any system, including logs and diagnostic output.
Transaction Authorization: The process by which a card issuer approves or declines a transaction based on the available funds, card status, and other factors. PCI DSS requires merchants to protect cardholder data during and after transaction authorization.
Transaction Data: Information related to a payment card transaction, such as the cardholder's name, account number, and transaction amount. PCI DSS mandates the protection of transaction data, both in storage and during transmission.
Transaction Identifier (Transaction ID): A unique reference number assigned to each payment card transaction, which can be used to trace the transaction through the payment processing system. Transaction identifiers are not considered sensitive data under PCI DSS.
Transport Layer Security (TLS): A cryptographic protocol that provides secure communication over a computer network, replacing the older Secure Sockets Layer (SSL) protocol. PCI DSS requires organizations to use strong encryption, such as TLS, to protect cardholder data during transmission.
Truncation: Permanently removing part of the primary account number so the full number can no longer be recovered from what remains, for example storing only the first six and last four digits. Truncation is one of the methods PCI DSS accepts for rendering a stored PAN unreadable. It is often confused with masking, but the two differ in a way that matters: masking hides digits at the point of display while the full PAN is still held, whereas truncation destroys the removed digits outright. Truncated data is out of scope; masked data is not.
Trusted Platform Module (TPM): A hardware component that provides cryptographic functions and secure storage for sensitive data, such as encryption keys. TPMs can help organizations enhance the security of their cardholder data environment and maintain PCI DSS compliance.
Trusted Third Party (TTP): An organization or individual that acts as an impartial intermediary between two or more parties, providing trust services such as identity verification, key management, or cryptographic services. TTPs can play a role in the security of cardholder data and the overall PCI DSS compliance process.
Trusted Zone: A segment of a network or system that is considered secure and protected from unauthorized access. Organizations must implement appropriate access controls and security measures to ensure that cardholder data remains within the trusted zone and maintains PCI DSS compliance.
Tunneling: The process of encapsulating one network protocol within another, typically for the purpose of securely transmitting data across a public network. Tunneling can be used to protect cardholder data during transmission, as required by PCI DSS.
Two-Factor Authentication (2FA): Multi-factor authentication using exactly two factors. 2FA is a subset of MFA rather than a separate control, and the same rule applies: the two factors must come from different categories, so a password paired with a security question does not qualify. Older PCI DSS versions framed the requirement as two-factor authentication for remote access; v4.x speaks in terms of multi-factor authentication and extends it to all access into the cardholder data environment, not only remote access. See Multi-factor Authentication (MFA) under M.
Twofish: A symmetric-key block cipher that was a finalist in the competition to select the Advanced Encryption Standard (AES). While Twofish is not as widely used as AES, it is considered to be a secure encryption algorithm and can be used to protect cardholder data in compliance with PCI DSS requirements.

U

Unified Threat Management (UTM): An approach to information security that combines multiple security functions, such as firewall, intrusion detection, and antivirus, into a single solution. UTM can help organizations streamline their security efforts and maintain PCI DSS compliance.
Unique Identifier (UID): A distinct and non-reusable value assigned to a specific entity, such as a user, system, or device, to differentiate it from others. Unique identifiers can be used to track and manage access to cardholder data and help maintain PCI DSS compliance.
Untrusted Network: A network that is not under the control of the organization and is considered potentially hostile or insecure. PCI DSS requires organizations to implement security measures to protect cardholder data when transmitted over untrusted networks.
User Acceptance Testing (UAT): A phase of software development where the intended users test the system to ensure it meets their requirements and functions correctly. UAT can help organizations identify and remediate potential security issues before they impact cardholder data and PCI DSS compliance.
User Account Management: The process of creating, maintaining, and deleting user accounts, as well as assigning and managing access rights and permissions. PCI DSS requires organizations to implement strong user account management practices to protect cardholder data.
User and Entity Behavior Analytics (UEBA): A security approach that leverages machine learning and advanced analytics to identify anomalous behavior and potential threats by analyzing user and system activity. UEBA can help organizations detect and respond to security incidents that may impact PCI DSS compliance.
User Identification: The process of uniquely identifying a user attempting to access a network or system, typically through the use of a username, email address, or other identifier. User identification is a critical component of access control and PCI DSS compliance.
User Training and Awareness: The process of educating users about security best practices, policies, and procedures to help protect cardholder data and maintain PCI DSS compliance. User training and awareness is a key component of a comprehensive information security program.
User-Managed Access (UMA): A protocol that enables users to manage and control access to their personal data by third-party applications and services. UMA can help organizations ensure that cardholder data is only accessed by authorized parties and maintain PCI DSS compliance.

V

Validation: The process of confirming that a system, application, or process meets specific requirements, such as security controls or PCI DSS requirements. Validation helps ensure that security measures are effective and functioning as intended.
Virtual Local Area Network (VLAN): A logical grouping of network devices that can span multiple physical network segments. VLANs can be used to segregate network traffic, such as cardholder data, to improve security and maintain PCI DSS compliance.
Virtual Machine (VM): A software-based emulation of a physical computer system that runs on a host system. VMs can be used to isolate sensitive environments, such as those containing cardholder data, from other systems, helping to maintain PCI DSS compliance.
Virtual Private Network (VPN): A secure network connection that uses encryption and tunneling to transmit data between remote users and a private network. VPNs can help protect cardholder data when transmitted over untrusted networks, supporting PCI DSS compliance.
Virtualization: The process of creating multiple virtual instances of a computer system, such as a server or desktop, on a single physical hardware platform. Virtualization can help organizations improve security and maintain PCI DSS compliance by isolating sensitive environments and reducing the attack surface.
Virus: A type of malicious software that can replicate itself and spread from one system to another, often causing harm or unauthorized access to data. Protecting systems against viruses is an important aspect of maintaining PCI DSS compliance.
Vulnerability: A weakness in a system, application, or process that can be exploited by an attacker to gain unauthorized access or cause harm. Identifying and mitigating vulnerabilities is a critical component of PCI DSS compliance and overall information security.
Vulnerability Assessment: The broader process of identifying vulnerabilities, judging what each one actually means in the context of the environment, ranking them by risk and deciding what to do about them. A vulnerability scan is one input to this; the assessment is the analysis around it. The distinction matters under PCI DSS, which requires vulnerabilities to be given a risk ranking reflecting the environment they sit in rather than the raw score a scanner reports, and requires that ranking to be documented and justified.
Vulnerability Management: An ongoing process of identifying, evaluating, and mitigating vulnerabilities in systems and applications to reduce the risk of security incidents. Vulnerability management is an important aspect of PCI DSS compliance and overall information security.
Vulnerability Scanning: The use of automated tools to check systems and networks against a database of known vulnerabilities and misconfigurations. PCI DSS requires two distinct kinds on different terms: external scanning, which must be performed by an Approved Scanning Vendor, and internal scanning, which may be performed by qualified staff and, under v4.x, must be authenticated. Both are required at least once every three months and after any significant change, and both require findings to be remediated and a rescan performed to confirm the fix. A scan that was run but never passed does not satisfy the requirement.

W

Weak Cryptography: The use of cryptographic algorithms or key lengths that are no longer considered secure due to advances in computing power or the discovery of vulnerabilities. Using weak cryptography can put cardholder data at risk and may result in non-compliance with PCI DSS requirements.
Web Application Firewall (WAF): A security solution that monitors, filters, and blocks HTTP traffic to and from web applications. WAFs can help protect web applications from common attacks, such as cross-site scripting (XSS) and SQL injection, and support PCI DSS compliance by providing an additional layer of security.
Whitelisting (Allow List): The practice of permitting only explicitly approved entities, such as IP addresses, domains or applications, and denying everything else by default. An allow list is the stronger of the two models because an unknown threat is blocked rather than permitted, which is why PCI DSS requires services, protocols and ports to be justified and approved rather than merely screened. Allow list is the current term; whitelisting is the older wording.
Wireless Access Point (WAP): A networking device that allows wireless devices to connect to a wired network. Securing WAPs and segregating wireless traffic containing cardholder data are important aspects of PCI DSS compliance.
Wireless Intrusion Prevention System (WIPS): A security solution designed to detect, prevent, and mitigate unauthorized access or attacks on wireless networks. WIPS can help organizations protect their wireless networks and maintain PCI DSS compliance.
Wireless Local Area Network (WLAN): A network that connects devices using wireless communication protocols, such as Wi-Fi. Securing WLANs and segregating wireless traffic containing cardholder data are important aspects of PCI DSS compliance.

X

X.509: A standard for digital certificates used in public key infrastructure (PKI) systems to establish secure communications between entities over a network. X.509 certificates are used in secure communication protocols such as TLS/SSL, which help protect cardholder data during transmission and support PCI DSS compliance.
XSS (Cross-Site Scripting): See Cross-site Scripting (XSS) under C for the full definition.

Z

Zero-Day Vulnerability: A security flaw in software or hardware that is unknown to the vendor and has not yet been patched. Zero-day vulnerabilities can be exploited by attackers before the vendor releases a fix, potentially compromising systems and data, including cardholder data. Addressing zero-day vulnerabilities is important for maintaining PCI DSS compliance and overall information security.
Zone-based Firewall: A type of firewall configuration that segments a network into multiple security zones, each with its own policies and rules. Zone-based firewalls can help organizations protect sensitive data, such as cardholder data, by restricting access to specific network segments, which supports PCI DSS compliance.