PCI DSS Glossary
414 terms, explained against PCI DSS v4.0.1. The entries for the payment page controls (6.4.3 and 11.6.1) and for scoping and SAQ eligibility carry an example, their limits, related terms and sources; start there.
PCIComplianceHubLast updated
A
- Access Control
- The process of granting or denying specific requests to obtain and use information and related information processing services.
- Access Control List (ACL)
- A list of permissions attached to an object, specifying which users or system processes are granted access to the object and what operations are allowed.
- Account
- The identifier under which a person or a process is known to a system: a user ID, an account ID, or an application ID.
Full entry: applies to, example, limits, 2 controls, 5 related terms, 2 sources
- Account Data
- The umbrella term for all data that PCI DSS protects. Account Data comprises Cardholder Data (primary account number, cardholder name, expiration date and service code) and Sensitive Authentication Data (full track data, card verification codes, and PINs or PIN blocks).
Full entry: applies to, example, limits, 3 controls, 5 related terms, 2 sources
- Acknowledgement and Resolution
- Two distinct dispositions for a change-detection alert. Acknowledgement records that someone has seen it and who, and stops there: the finding stays open.
- Acquirer
- A financial institution that processes payment card transactions on behalf of merchants.
Full entry: applies to, example, limits, 1 control, 6 related terms, 3 sources
- Active Directory
- A Microsoft directory service used to manage users, computers, and other devices on a network.
- Administrative Access
- Elevated privileges that let an account manage a system, network or application rather than merely use it: root, administrator, superuser, sysadmin and their equivalents, whether held by a person's own account or by a built-in system account.
Full entry: applies to, example, limits, 5 controls, 5 related terms, 2 sources
- Advanced Encryption Standard (AES)
- A widely-used symmetric encryption algorithm that supports key lengths of 128, 192, and 256 bits.
Full entry: applies to, example, limits, 6 related terms, 2 sources
- Algorithm
- A defined sequence of steps that turns an input into an output.
Full entry: applies to, limits, 5 controls, 5 related terms, 2 sources
- Anomaly Detection
- The process of identifying unusual patterns or behaviors within a dataset or system, which may indicate a security threat or compromise.
- Anti-Malware
- Software that detects, and then blocks, removes or contains, malicious software of every kind: viruses, worms, ransomware, spyware and the rest.
Full entry: applies to, example, limits, 7 controls, 6 related terms, 2 sources
- Application
- Any software program or group of programs an entity runs, whether bought, custom-built or bespoke, and whether internal or external-facing such as a website.
Full entry: applies to, example, limits, 4 controls, 5 related terms, 2 sources
- Application and System Accounts
- Accounts that exist for a process or a service rather than for a person: the identity a batch job, a database connection or a monitoring agent runs under.Also. Service accounts
Full entry: applies to, example, limits, 6 controls, 5 related terms, 2 sources
- Application Layer Firewall
- A firewall that operates at the application layer of the OSI model, filtering traffic based on the content of the data packets, rather than just the source and destination IP addresses.
- Application Security
- The process of ensuring the security of software applications by identifying and mitigating vulnerabilities, implementing secure coding practices, and using security testing tools.
- Approved Scanning Vendor (ASV)
- A company approved by the PCI SSC to perform the external vulnerability scans PCI DSS requires, using a scanning solution the Council has tested.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 3 sources
- Asset
- Anything of value to an entity that its security programme has to account for: hardware, software, data, and the people and processes around them.
Full entry: applies to, limits, 1 control, 5 related terms, 1 source
- Asymmetric Encryption
- Encryption using a matched pair of keys: a public key that can be shared freely and a private key that must be protected.
- Attack Surface
- The set of points in a system where an attacker can attempt to gain unauthorized access, exploit vulnerabilities, or compromise the system.
- Attestation of Compliance (AOC)
- The Council's form on which an entity declares the result of its PCI DSS assessment: which SAQ or ROC it completed, the scope covered, the date, and whether it was compliant.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 2 sources
- Attestation of Scan Compliance
- The document an Approved Scanning Vendor issues to summarise the outcome of an external vulnerability scan, stating whether the scan passed and confirming that the scan customer and the ASV agree the scope was complete.
- Audit
- A systematic examination of an organization's security controls, policies, and procedures to ensure compliance with a given set of standards, such as PCI DSS.
- Audit Log / Audit Trail
- A chronological record of activity on a system: who did what, to which resource, from where and when.Also. Audit Log, Audit Trail, Log
Full entry: applies to, example, limits, 8 controls, 6 related terms, 2 sources
- Authenticated Internal Vulnerability Scan
- An internal vulnerability scan performed with credentials that let the scanner log in to each system component and inspect it from the inside, rather than probing it only across the network.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 1 source
- Authentication
- Proving that the account attempting access belongs to the person, device or process claiming it, by presenting one or more authentication factors: something known, something held, or something the claimant is.
Full entry: applies to, example, limits, 5 controls, 6 related terms, 2 sources
- Authentication Credential
- An account identifier together with the authentication factor or factors used to prove it: a user ID plus its password, a badge plus its PIN, a certificate bound to a device.
Full entry: applies to, example, limits, 2 controls, 5 related terms, 2 sources
- Authentication Factor
- The thing that proves an account is being used by who it belongs to: something you know (a password or passphrase), something you have (a token device, smart card or registered phone), or something you are (a biometric).
Full entry: applies to, example, limits, 3 controls, 6 related terms, 2 sources
- Automated Log Review
- The use of tooling, such as a SIEM or log analytics platform, to review audit logs and surface anomalies, rather than relying on people reading logs by hand.
Full entry: applies to, example, limits, 3 controls, 6 related terms, 1 source
B
- Backdoor
- A hidden method of bypassing normal authentication or security controls to gain unauthorized access to a system, often created by an attacker or included intentionally by developers for debugging purposes.
- Backup
- A copy of data, software, or system configurations that can be used to restore the original in the event of data loss, corruption, or system failure.
- Baseline (Change Detection)
- In change detection, the recorded prior state a new observation is compared against: the hashes of the scripts seen on a payment page, and the security-relevant response headers it returned.
Full entry: applies to, example, limits, 1 control, 4 related terms, 1 source
- Baseline Security
- A set of minimum security measures or controls implemented to protect an organization's information systems and data from threats.
- BAU (Business as Usual)
- The Council's term for security that runs as part of normal operations rather than as an annual event before the assessment: controls monitored continuously, failures detected and responded to, changes assessed for their effect on scope and on the controls, and responsibilities assigned and understood.
Full entry: applies to, example, limits, 3 controls, 5 related terms, 2 sources
- Bespoke and Custom Software
- The v4.x term for software written for one organization rather than sold off the shelf.
Full entry: applies to, example, limits, 6 controls, 6 related terms, 2 sources
- Biometrics
- The use of unique physical or behavioral characteristics, such as fingerprints or facial recognition, to identify and authenticate individuals.
- Block List (Blacklist)
- A list of entities, such as IP addresses, domains or applications, that are denied access to a system because they are known or suspected to be malicious.Also. Block list, Blocklist, Deny list
- Bluetooth
- A wireless technology standard used for exchanging data between devices over short distances, which may pose security risks if not properly secured.
- Botnet
- A network of compromised computers, servers, or other devices that are remotely controlled by an attacker to perform malicious activities, such as launching distributed denial-of-service (DDoS) attacks.
- Brute Force Attack
- An attempt to crack a password or encryption key by systematically trying every possible combination of characters until the correct one is found.
- Buffer Overflow
- A vulnerability that occurs when an application writes more data to a buffer than it can hold, causing the excess data to overwrite adjacent memory locations and potentially leading to unauthorized access or system crashes.
- Bug
- A flaw or error in software or hardware that can lead to unexpected behavior, security vulnerabilities, or system crashes.
- Business Continuity Plan (BCP)
- A documented plan outlining the steps an organization will take to ensure the continued availability of critical functions and systems in the event of a disruption or disaster.
- Business Impact Analysis (BIA)
- A process used to identify and assess the potential impact of a disruption on an organization's critical functions and systems, helping prioritize recovery efforts and develop business continuity plans.
- BYOD (Bring Your Own Device)
- A policy that allows employees to use their personal devices, such as smartphones or laptops, for work-related activities, which may introduce security risks if not properly managed and secured.
- Byte
- A unit of digital information consisting of eight bits, commonly used to represent a single character of text or other data.
C
- Card Skimmer
- A physical device fitted to or inside a legitimate card reader to capture and store the data from cards inserted or swiped through it, usually with a camera or false keypad to capture the PIN as well.
Full entry: applies to, example, limits, 4 controls, 5 related terms, 2 sources
- Card Testing
- An attack in which stolen card numbers are validated in bulk by pushing large volumes of small or zero-value authorisations through a merchant payment form, to find out which cards still work before they are used elsewhere.
- Card Verification Code (CVC)/Card Verification Value (CVV)
- A three or four-digit value carried by a payment card and used to check that the card itself is in the hands of the person making the transaction.Also. Card Verification Code, CVV2, CVC2, CID, CAV2
Full entry: applies to, example, limits, 2 controls, 5 related terms, 2 sources
- Card-Not-Present Transaction (CNP)
- A transaction where the card is not physically read by a terminal, covering e-commerce, mail order and telephone order.
- Card-Present Transaction
- A transaction where the physical card or a provisioned device is at the point of sale and is read by a terminal, whether by chip, contactless or magnetic stripe.
- Cardholder
- The customer a payment card is issued to, or anyone authorised to use it.
Full entry: applies to, example, limits, 6 related terms, 2 sources
- Cardholder Data
- The primary account number together with the cardholder name, expiration date and service code.Also. CHD
Full entry: applies to, example, limits, 2 controls, 6 related terms, 2 sources
- Cardholder Data Environment (CDE)
- The people, processes and system components that store, process or transmit cardholder data or sensitive authentication data.
Full entry: applies to, example, limits, 3 controls, 6 related terms, 2 sources
- Change Control
- The procedures by which a change to a system or to software is reviewed, tested and approved for its effect before it is made.
Full entry: applies to, example, limits, 3 controls, 5 related terms, 2 sources
- Change Management
- The process of controlling and documenting changes to systems, software, or hardware to minimize the risk of disruptions, security vulnerabilities, or unauthorized modifications.
- Change-and-Tamper Detection Mechanism
- A control that watches a payment page as the consumer's browser actually receives it and alerts on unauthorized modification to its HTTP headers or its contents.
Full entry: applies to, example, limits, 2 controls, 7 related terms, 1 source
- Chargeback
- A forced reversal of a card transaction, initiated by the issuer on the cardholder behalf, typically because the transaction is disputed as fraudulent, unauthorized or not as described.
Full entry: applies to, limits, 1 control, 5 related terms, 1 source
- Checksum
- A value calculated from a data set, such as a file or message, used to verify its integrity by detecting errors or alterations in the data.
- Cipher
- An algorithm for encrypting and decrypting data: the mathematical procedure that, with a key, turns readable data into ciphertext and back.
Full entry: applies to, limits, 2 controls, 5 related terms, 1 source
- Ciphertext
- Data after encryption: unreadable without the key that decrypts it.
- Cleartext Data
- Data that is not encrypted: readable as it stands, by anyone who can reach it.Also. Cleartext, Plaintext
Full entry: applies to, example, limits, 4 controls, 6 related terms, 2 sources
- Cloud Computing
- The delivery of computing services, such as storage, processing power, and applications, over the internet from remote data centers, which may introduce new security risks and compliance considerations.
- Column-Level Database Encryption
- Encrypting the contents of a particular database column, such as the one holding PAN, rather than the whole database or the disk underneath it.
Full entry: applies to, example, limits, 3 controls, 6 related terms, 2 sources
- Commercial Off-the-Shelf (COTS)
- Products sold as stock items, not built or customised for a particular customer, and ready to use as supplied.
Full entry: applies to, example, limits, 6 related terms, 2 sources
- Compensating Control Worksheet (CCW)
- The template, provided in PCI DSS Appendix C, used to document every compensating control.
- Compensating Controls
- Alternative controls used when an organization cannot meet a PCI DSS requirement as written because of a documented technical or business constraint.
Full entry: applies to, example, limits, 3 related terms, 2 sources
- Compliance
- The process of adhering to established regulations, standards, or policies, such as PCI DSS, to ensure the security of sensitive data and the proper functioning of information systems.
Full entry: applies to, limits, 5 controls, 5 related terms, 1 source
- Compromise
- An intrusion into a system where unauthorised disclosure, theft, modification or destruction of cardholder data is suspected.Also. Data compromise, Data breach
Full entry: applies to, example, limits, 3 controls, 6 related terms, 2 sources
- Confidentiality
- The principle of ensuring that sensitive information is accessible only to authorized individuals, systems, or entities, and is protected from unauthorized access or disclosure.
- Connected-to or Security-Impacting System
- A system component that does not store, process or transmit account data itself but can still affect the security of the cardholder data environment, and is therefore in scope for PCI DSS.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 1 source
- Console
- A screen and keyboard connected directly to a system, so that using it means being physically at the machine.
Full entry: applies to, example, limits, 3 controls, 5 related terms, 2 sources
- Consumer
- An individual cardholder buying goods or services. The standard uses the word where it needs the person at the other end of a transaction, most visibly in Requirements 6.4.3 and 11.6.1, which are written about the consumer's browser.
Full entry: applies to, example, limits, 2 controls, 5 related terms, 2 sources
- Contactless Payment
- A transaction where the card or device is tapped against a terminal rather than inserted or swiped, using near-field communication.
- Content Security Policy (CSP)
- An HTTP response header telling the browser which sources it may load and execute scripts, styles, frames and other resources from, and which it must block.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 3 sources
- Controls Matrix
- The document an organization produces for each requirement it meets through the Customized Approach, describing the control in place, how it meets the customized approach objective, how its effectiveness is tested and maintained, and who is accountable for it.
Full entry: applies to, limits, 1 control, 5 related terms, 1 source
- Coverage Satisfied
- The state recorded when every actively monitored payment page was seen in full by its most recent evaluation.
- Coverage Unknown
- The state recorded when the measurements a coverage claim would rest on are missing or malformed, so no claim is made about whether a page was fully seen.
- CPoC (Contactless Payments on COTS)
- A PCI Security Standards Council standard for solutions that accept contactless payments using the built-in NFC reader of an ordinary phone or tablet, with no additional hardware.
- Critical Systems
- The systems and technologies an entity judges to be of particular importance: those a business operation or a security function depends on.
Full entry: applies to, example, limits, 4 controls, 5 related terms, 2 sources
- Cross-site Scripting (XSS)
- A type of web application vulnerability where an attacker injects malicious scripts into trusted websites, causing them to be executed by a victim's browser and potentially leading to data theft or unauthorized actions.
- Cryptographic Architecture
- A documented description of how cryptography is used across an environment: the algorithms, protocols and cipher suites in use, the keys and certificates involved, where each is applied, and the plan for responding when an algorithm or protocol weakens.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 1 source
- Cryptographic Key
- A value used with a cryptographic algorithm to transform data, most commonly to encrypt or decrypt it.
Full entry: applies to, example, limits, 7 controls, 6 related terms, 2 sources
- Cryptographic Key Generation
- The process of creating a new secret or private cryptographic key for use with a cryptographic algorithm.
Full entry: applies to, example, limits, 1 control, 6 related terms, 2 sources
- Cryptography
- The practice of securing communication and data storage by using mathematical techniques to encrypt and decrypt information, ensuring its confidentiality, integrity, and authenticity.
- Cryptoperiod
- The defined period during which a specific cryptographic key is authorised for use, after which it must be retired and replaced.
Full entry: applies to, example, limits, 2 controls, 5 related terms, 3 sources
- Customer Information
- Any data related to customers, such as names, addresses, phone numbers, or email addresses, that may be subject to privacy regulations and require protection from unauthorized access or disclosure.
- Customized Approach
- A method introduced in PCI DSS v4.0 that lets an organization meet the stated objective of a requirement through controls of its own design, rather than by implementing the requirement exactly as written.
Full entry: applies to, example, limits, 1 control, 6 related terms, 2 sources
- Customized Approach Objective
- The security outcome a PCI DSS requirement is intended to achieve, stated in the standard alongside each eligible requirement.
- CVE (Common Vulnerabilities and Exposures)
- The public catalogue of disclosed security vulnerabilities, each given a unique identifier in the form CVE-YYYY-NNNNN.
- CVSS (Common Vulnerability Scoring System)
- An open standard, maintained by FIRST, that scores the severity of a vulnerability from 0.0 to 10.0.
Full entry: applies to, example, limits, 1 control, 6 related terms, 2 sources
- Cybersecurity
- The practice of protecting computers, networks, and data from digital threats, such as unauthorized access, data breaches, malware, or denial-of-service attacks.
D
- Data Breach
- An incident in which unauthorized individuals gain access to sensitive information, such as payment card data, personal information, or intellectual property.
- Data Encrypting Key (DEK)
- The cryptographic key that actually encrypts and decrypts stored or transmitted data, as distinct from a key encrypting key that protects other keys.
Full entry: applies to, limits, 2 controls, 4 related terms, 1 source
- Data Encryption Standard (DES)
- A widely used symmetric-key encryption algorithm, now considered insecure due to its relatively short key length and susceptibility to brute-force attacks.
- Data Flow Diagram
- A visual representation of how data moves through an organization's systems and processes, often used to identify potential security risks or vulnerabilities.
Full entry: applies to, example, limits, 2 controls, 5 related terms, 2 sources
- Data Loss Prevention (DLP)
- Technologies and processes designed to prevent the unauthorized disclosure, alteration, or destruction of sensitive information, both in transit and at rest.
- Default Account
- A pre-configured user account, often created by software vendors or system administrators, which may have known usernames and passwords, increasing the risk of unauthorized access if not properly managed.
Full entry: applies to, example, limits, 1 control, 5 related terms, 2 sources
- Default Password
- A pre-set password provided by software vendors or hardware manufacturers, which should be changed by the user to prevent unauthorized access.
Full entry: applies to, example, limits, 2 controls, 5 related terms, 2 sources
- Defined Approach
- The traditional method of meeting PCI DSS, in which an organization implements each requirement as written and the assessor tests it against the defined testing procedures published in the standard.
Full entry: applies to, example, limits, 6 related terms, 2 sources
- Denial of Service (DoS)
- An attack that overwhelms a system, network, or service with excessive traffic or requests, rendering it unavailable to legitimate users.
- Digital Certificate
- An electronic document issued by a certificate authority (CA) that verifies the identity of a website, individual, or organization and enables secure communication through encryption.
- Digital Signature
- A cryptographic technique used to verify the authenticity and integrity of a message, document, or software, by ensuring it has not been altered and was created by a specific sender.
- Direct Post
- An integration in which the payment form is served from the merchant origin but submits card data straight to the provider, bypassing the merchant server.
Full entry: applies to, example, limits, 2 controls, 5 related terms, 1 source
- Directory Traversal
- A type of cyberattack where an attacker exploits vulnerabilities in web applications to access restricted directories and files, potentially leading to unauthorized access to sensitive information.
- Discretionary Data
- Additional issuer-defined data held in the tracks of a payment card magnetic stripe beyond the standard fields, including the card validation value CVV1 or CAV1.
- Disk Encryption
- Encrypting a whole disk or partition so that its contents are unreadable without the key when the disk is at rest.
- Distributed Denial of Service (DDoS)
- A coordinated denial of service attack, where multiple systems are used to flood a target with excessive traffic or requests, overwhelming its resources and causing it to become unavailable.
- DMZ (Demilitarized Zone)
- A network segment, often positioned between an organization's internal network and the internet, where public-facing systems are isolated to limit exposure and reduce the potential impact of a security breach.
Full entry: applies to, example, limits, 3 controls, 5 related terms, 2 sources
- DOM (Document Object Model)
- The live, in-memory representation of a page that the browser builds and that scripts read and rewrite after the HTML arrives.
Full entry: applies to, example, limits, 1 control, 5 related terms, 2 sources
- Domain Name System (DNS)
- A hierarchical system for translating human-readable domain names (such as example.com) into the IP addresses used by computers to identify each other on the internet.
Full entry: applies to, example, limits, 5 related terms, 2 sources
- Dual Control
- A security principle that requires two or more individuals to perform certain actions, such as approving a transaction or accessing sensitive information, to reduce the risk of fraud or error.
Full entry: applies to, example, limits, 1 control, 5 related terms, 2 sources
- DUKPT (Derived Unique Key Per Transaction)
- A key management scheme in which every transaction is encrypted under a distinct key derived from a base key and a transaction counter, so no two transactions share a key and a compromised key exposes only one transaction.
E
- E-commerce
- Accepting card payments over the internet, through a website or application in which the customer enters their own card data.
Full entry: applies to, example, limits, 2 controls, 7 related terms, 1 source
- E-commerce (web) Redirection Server
- The merchant-side server that sends a customer's browser from the merchant's website to another location, the payment provider's page, to enter card data.
Full entry: applies to, example, limits, 1 control, 5 related terms, 5 sources
- E-Skimming
- The online equivalent of skimming, also known as digital skimming, formjacking or Magecart.Also. Digital skimming, Formjacking, Magecart
Full entry: applies to, example, limits, 2 controls, 7 related terms, 3 sources
- EMV (Chip Card)
- The global standard for chip-based payment cards and the terminals that accept them, named after Europay, Mastercard and Visa.
- Encryption
- The reversible transformation of data into ciphertext with an encryption algorithm and a key, so that only a holder of the matching key can read it.
Full entry: applies to, example, limits, 6 controls, 6 related terms, 2 sources
- Encryption Algorithm
- A mathematical formula used to encrypt and decrypt data, ensuring that only authorized parties with the correct decryption key can access the original information.Also. Cryptographic Algorithm
Full entry: applies to, example, limits, 3 controls, 6 related terms, 2 sources
- Encryption Key
- A cryptographic key used specifically to encrypt and decrypt data, as opposed to keys used for signing, message authentication or wrapping other keys.
Full entry: applies to, limits, 2 controls, 4 related terms, 1 source
- Endpoint Security
- The practice of protecting devices such as computers, smartphones, and tablets from threats, vulnerabilities, and unauthorized access when connected to a network.
- Enterprise Security
- The strategies, policies, and technologies used to protect an organization's information, systems, and infrastructure from internal and external threats.
- Entity
- The Council's word for whichever organisation is being assessed: a merchant, a service provider, an issuer or anyone else to whom PCI DSS applies.
Full entry: applies to, example, limits, 1 control, 5 related terms, 2 sources
- Event Log
- The chronological record of what happened on a system: logins, changes, errors, access to data.
- Exfiltration
- Moving data out of an entity's control without authorisation: the step in a compromise where the attacker takes what they came for.
- Exploit
- A piece of software, a set of data, or a sequence of commands that takes advantage of a vulnerability in a system or application to cause unintended behavior or gain unauthorized access.
- Extended Validation (EV) SSL Certificate
- A type of digital certificate that provides a higher level of assurance regarding the identity of a website, organization, or individual by requiring more rigorous validation processes.
- External Vulnerability Scanning
- Scanning performed from outside the network against every internet-facing IP address and domain in scope, to find what an attacker on the internet could reach.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 2 sources
- Extranet
- A private network that allows controlled access to authorized external users, such as business partners, customers, or suppliers, while maintaining security and privacy.
F
- Failover
- A backup operational mode in which the functions of a system component are assumed by a secondary component when the primary component becomes unavailable due to failure or scheduled maintenance.
- False Negative
- A failure of a security system to detect or alert on a malicious activity or event, allowing the threat to go unnoticed and potentially cause harm.
- False Positive
- An alert or detection by a security system that incorrectly identifies a benign activity or event as malicious, potentially leading to unnecessary investigations or actions.
- Federated Identity
- A method of linking and managing a user's identity across multiple systems or organizations, allowing for single sign-on (SSO) and simplified access control.
- File Integrity Monitoring
- A security process that involves monitoring and detecting changes to files and system components, such as configuration files or application binaries, to identify unauthorized modifications, malware, or other security threats.
Full entry: applies to, example, limits, 4 controls, 6 related terms, 2 sources
- File Level Encryption
- Encryption applied to individual files, columns or database fields rather than to a whole drive.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 2 sources
- File Transfer Protocol (FTP)
- A standard network protocol used for transferring files between a client and server over a TCP/IP-based network, such as the internet.
Full entry: applies to, example, limits, 3 controls, 5 related terms, 2 sources
- FIPS (Federal Information Processing Standards)
- A set of standards and guidelines for the security of non-classified information systems used by the United States federal government, including encryption algorithms and key management practices.
- Firewall
- Hardware or software that permits or denies traffic between networks of different trust levels according to a set of rules.
Full entry: applies to, example, limits, 3 controls, 7 related terms, 2 sources
- Firewall Rule
- A configuration setting within a firewall that defines the criteria for allowing or blocking network traffic based on factors such as source, destination, port, or protocol.
- Firmware
- Software that is embedded within a hardware device, such as a router or payment terminal, to provide low-level control and management of the device's functions and operations.
Full entry: applies to, limits, 1 control, 5 related terms, 2 sources
- First-Party Fraud
- Fraud committed by the account holder, often involving the use of their own payment card or account, with the intention of defrauding the issuing bank or merchant.
- Forensics
- The use of investigative tools and analysis techniques to gather evidence from systems and determine how a compromise happened.Also. Computer forensics
Full entry: applies to, example, limits, 2 controls, 5 related terms, 2 sources
- FPE (Format Preserving Encryption)
- An encryption method that maintains the original format of the plaintext data after it has been encrypted, enabling it to be processed or stored in systems that require specific formats without the need for decryption.
- Fraud Detection
- The process of monitoring and analyzing transactions, events, or activities to identify and prevent fraudulent activities, such as unauthorized charges or account takeovers.
- Full-Disk Encryption (FDE)
- Encryption of an entire storage drive, including the operating system, applications and data, so the contents are unreadable without the decryption key.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 1 source
- Function Level Access Control
- A security mechanism that restricts access to specific functions or features within a system or application based on the user's role or privileges.
- Future-Dated Requirement
- A requirement published in PCI DSS v4.0 but marked as a best practice until 31 March 2025, giving organizations time to plan and budget for it before it was assessed.
- Fuzz Testing
- A type of software testing that involves inputting random, malformed, or unexpected data into a system or application to discover potential vulnerabilities, crashes, or other issues.
G
- Gap Analysis
- A process used to identify and assess the differences between an organization's current state and a desired or required state, such as compliance with a security standard or best practice.
- Gateway
- A network device that acts as an intermediary between different networks, facilitating communication and data transfer while enforcing security policies and access controls.
- GDPR (General Data Protection Regulation)
- A European Union regulation that governs the protection and processing of personal data, requiring organizations to implement appropriate security measures and obtain consent from individuals before collecting, storing, or processing their data.
- Geofencing
- A location-based security mechanism that establishes a virtual boundary around a specific geographical area, triggering actions or alerts when a device enters or leaves the defined area.
- Geolocation
- The process of identifying the physical location of a device or user based on factors such as IP address, GPS data, or other network and device attributes.
- Ghost Terminal
- A fraudulent payment terminal or point of sale (POS) device, often designed to resemble a legitimate device, used by criminals to capture cardholder data during transactions.
- GPG (GNU Privacy Guard)
- An open-source implementation of the Pretty Good Privacy (PGP) encryption standard, used for securing email communication, digital signatures, and other sensitive data.
- Granular Access Control
- A security model that provides fine-grained control over user access to specific resources, functions, or data within a system or application, based on criteria such as user roles, privileges, or attributes.
- GRC (Governance, Risk, and Compliance)
- A management approach that encompasses the processes, policies, and tools used by organizations to ensure adherence to legal, regulatory, and industry requirements, as well as to manage and mitigate risks and support effective decision-making.
- Greylisting
- An anti-spam technique that temporarily rejects incoming emails from unknown or suspicious senders, requiring them to resend the message after a certain period, with the assumption that legitimate senders will retry while spammers will not.
- Group Policy
- A Microsoft Windows feature that enables administrators to centrally manage and enforce configurations, security settings, and other policies for users and computers within an Active Directory domain.
- GSM (Global System for Mobile Communications)
- A widely used mobile communication standard that provides voice, data, and messaging services, including features such as encryption and authentication to protect against eavesdropping and unauthorized access.
- Guard
- In the context of information security, a guard is a security mechanism that enforces access control policies between different security domains or network segments, preventing unauthorized data flows or communications.
- GUI (Graphical User Interface)
- A type of user interface that allows users to interact with a system or application through graphical elements, such as buttons, icons, and menus, rather than text-based commands.
- GUID (Globally Unique Identifier)
- A unique, 128-bit number used to identify resources, objects, or entities across different systems, ensuring that each identifier is distinct and not reused.
H
- Hardware Security Module (HSM)
- A specialized, tamper-resistant device used to manage and protect cryptographic keys, perform encryption and decryption operations, and ensure the secure storage and processing of sensitive data.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 2 sources
- Hash Drift
- The change-detection finding that a script already present on a payment page now hashes differently from its baseline, meaning its contents changed while its URL stayed the same.
Full entry: applies to, example, limits, 1 control, 6 related terms, 1 source
- Hash Function
- A cryptographic algorithm that takes an input (or "message") and returns a fixed-size string of bytes, typically used for verifying data integrity by creating a unique "fingerprint" or "hash value" for a given piece of data.
- Hashing
- The process of applying a hash function to input data, resulting in a unique hash value that can be used for data integrity checks, password storage, or other security purposes.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 2 sources
- Heap Overflow
- A type of buffer overflow vulnerability that occurs when a program writes data beyond the allocated space in memory, potentially leading to crashes, data corruption, or the execution of arbitrary code by an attacker.
- Heuristic Analysis
- A method of detecting malware or other threats based on behavioral patterns, characteristics, or other indicators, rather than relying on specific signatures or known attributes.
- HIDS (Host-based Intrusion Detection System)
- A security solution that monitors individual host systems, such as servers or workstations, for suspicious activity, unauthorized changes, or potential security threats, and alerts administrators when issues are detected.
- High Availability
- A system design approach that aims to ensure continuous operation and minimize downtime by incorporating redundancy, fault tolerance, and other measures to protect against hardware failures, software errors, or other disruptions.
- HMAC (Hashed Message Authentication Code)
- A specific type of message authentication code (MAC) that combines a cryptographic hash function with a secret key, used to ensure the integrity and authenticity of transmitted data.
- Honeypot
- A security mechanism that simulates a vulnerable system or network resource, designed to attract and detect attackers or intruders, and gather information about their techniques and objectives.
- Hosted Payment Page
- A payment page served entirely by a provider, on the provider domain, either embedded in an iframe or reached by a redirect.
Full entry: applies to, example, limits, 6 related terms, 2 sources
- Hot Site
- A fully operational, off-site facility that can be quickly activated in the event of a disaster or disruption, providing an organization with the necessary infrastructure, resources, and connectivity to maintain critical operations and services.
- HTTP (Hypertext Transfer Protocol)
- The primary protocol used for transmitting and receiving data over the World Wide Web, which defines how web browsers and servers communicate and exchange information.
- HTTP Strict Transport Security (HSTS)
- A response header, Strict-Transport-Security, by which a site tells browsers to use HTTPS only for that host for a stated period, so that a later plain-HTTP link or typed address is upgraded before any request is sent, and a certificate error cannot be clicked through.
Full entry: applies to, example, limits, 2 controls, 4 related terms, 2 sources
- HTTPS (Hypertext Transfer Protocol Secure)
- An extension of HTTP that incorporates encryption using SSL/TLS, providing secure communication and data transfer between web browsers and servers.
- Hybrid Cloud
- A cloud computing model that combines elements of both public and private clouds, allowing organizations to balance the flexibility, scalability, and cost benefits of public cloud services with the control and security of private cloud infrastructure.
- Hypervisor
- A software or hardware component that creates and manages virtual machines, enabling multiple operating systems to run simultaneously on a single physical host.
I
- Identification
- The process of recognizing and distinguishing a user, system, or device based on a unique identifier, such as a username, IP address, or device ID, which forms the basis for authentication and access control.
- Identity and Access Management (IAM)
- A framework of policies, procedures, and technologies used to manage user identities, authenticate users, and enforce access controls, ensuring that only authorized individuals have access to specific resources and data.
- Identity Proofing
- The process of verifying a user's identity by confirming the authenticity of their personal information and credentials, such as government-issued identification documents, biometric data, or knowledge-based questions.
- Iframe (Inline Frame)
- An HTML element that embeds a separate document, from a separate origin, inside a page.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 5 sources
- Incident Management
- The process of identifying, analyzing, and responding to security incidents, including the containment, eradication, and recovery of affected systems, and the implementation of measures to prevent future occurrences.
- Incident Response Plan
- A documented plan for detecting, containing, eradicating and recovering from a security incident, covering roles and responsibilities, communication paths, escalation, evidence handling and return to normal operation.
Full entry: applies to, example, limits, 5 controls, 6 related terms, 1 source
- Index Token
- A random value, drawn from a table of random values, that stands in for a particular PAN.
Full entry: applies to, example, limits, 1 control, 5 related terms, 2 sources
- Information Security
- The practice of protecting the confidentiality, integrity, and availability of information from unauthorized access, disclosure, modification, or destruction, through the application of administrative, technical, and physical controls.
- Information Security Management System (ISMS)
- A systematic approach to managing and maintaining an organization's information security, which includes the establishment of policies, procedures, risk assessments, and controls, as well as the monitoring and continuous improvement of security measures.
- Ingress Filtering
- A network security technique that involves filtering incoming traffic based on source IP addresses, blocking packets from unauthorized or malicious sources, and preventing certain types of attacks, such as spoofing or denial-of-service (DoS).
- Injection Attack
- A type of security vulnerability that occurs when an attacker is able to insert or inject malicious code or commands into an application or system, potentially leading to unauthorized access, data theft, or other adverse consequences.Also. SQL injection, LDAP injection, Command injection
- Insider Threat
- A potential security risk originating from individuals within an organization, such as employees, contractors, or partners, who have access to sensitive information, systems, or resources, and may intentionally or unintentionally cause harm.
- Integrity
- A fundamental principle of information security that ensures the accuracy and consistency of data, preventing unauthorized modification or corruption, and providing assurance that information can be relied upon for its intended purpose.
- Interactive Login
- A person entering credentials to log in directly to an application or system account, as opposed to that account being used by the process it exists for.
Full entry: applies to, example, limits, 2 controls, 5 related terms, 2 sources
- Internal Security Assessor (ISA)
- An employee who has completed PCI Security Standards Council training and certification, qualifying them to perform PCI DSS assessments for their own organization.
- Internal Vulnerability Scanning
- Scanning performed from inside the network to identify vulnerabilities on system components in and connected to the cardholder data environment.
Full entry: applies to, limits, 4 controls, 5 related terms, 1 source
- Internet of Things (IoT)
- A network of interconnected devices, such as sensors, appliances, or wearables, that communicate and exchange data over the internet, enabling various applications, services, and automation capabilities.
- Intrusion Detection System (IDS)
- A security solution that monitors network traffic or system activity for signs of unauthorized access, malicious activity, or potential security threats, and generates alerts or notifications when suspicious events are detected.
Full entry: applies to, example, limits, 4 controls, 6 related terms, 2 sources
- Intrusion Prevention System (IPS)
- An extension of intrusion detection systems that not only detects potential threats but also takes automated actions to block or prevent malicious activity, such as dropping packets, terminating connections, or reconfiguring network devices.
Full entry: applies to, example, limits, 4 controls, 6 related terms, 2 sources
- Inventory Management
- The process of tracking and maintaining an organization's hardware, software, and other assets, including the identification, classification, and documentation of assets, as well as the implementation of controls to ensure their proper use and protection.
- Issuer
- The financial institution that issues payment cards to cardholders, holds the cardholder account and carries the credit risk on it.
Full entry: applies to, example, limits, 1 control, 6 related terms, 2 sources
- Issuing Services
- Services performed on behalf of a card issuer: authorising transactions, personalising cards, and the like.
Full entry: applies to, example, limits, 1 control, 4 related terms, 2 sources
J
- Jump Server
- Also known as a jump host or bastion host, a jump server is a secure, intermediate server placed between a user's device and a target system or network, providing an additional layer of security and access control.
K
- Key Custodian
- A named individual formally assigned responsibility for a cryptographic key or key component.
Full entry: applies to, example, limits, 3 controls, 5 related terms, 2 sources
- Key Encrypting Key (KEK)
- A cryptographic key used to encrypt other keys rather than data.
Full entry: applies to, limits, 2 controls, 4 related terms, 1 source
- Key Management
- The process of managing cryptographic keys, including their generation, distribution, storage, use, and disposal.Also. Cryptographic Key Management
Full entry: applies to, example, limits, 8 controls, 6 related terms, 2 sources
- Key Management System
- The combination of hardware and software that generates, distributes and manages cryptographic keys for the devices and applications that use them.Also. KMS
Full entry: applies to, example, limits, 5 controls, 7 related terms, 2 sources
- Key Rotation
- The practice of periodically changing cryptographic keys used for encryption and decryption to reduce the risk of unauthorized access to sensitive data.
- Keyed Cryptographic Hash
- A hash computed with a secret key as well as the input, so that the output cannot be recomputed by anyone without the key.
Full entry: applies to, example, limits, 2 controls, 7 related terms, 2 sources
- Keylogger
- A type of malicious software or hardware that captures and records users' keystrokes, typically with the intent of stealing sensitive information such as passwords, credit card numbers, or other personal data.
L
- Least Privilege
- The principle of granting users or systems the minimum level of access necessary to perform their tasks or functions.Also. Least Privileges
Full entry: applies to, example, limits, 4 controls, 6 related terms, 2 sources
- Legal Exception
- A situation where meeting a PCI DSS requirement would break a local or regional law or regulation.
Full entry: applies to, example, limits, 5 related terms, 2 sources
- Log Management
- The lifecycle around log data: collecting it from across the estate, centralising it, protecting it from alteration or deletion, retaining it for a defined period, reviewing it and disposing of it.
- Logging
- The act of recording events as they occur in a system, application or network device.
Full entry: applies to, limits, 3 controls, 5 related terms, 1 source
- Logical Access Control
- The mechanisms on a system that decide which authenticated users and applications may reach which information or processing resources: operating system permissions, application roles, database grants and access control lists, as distinct from the locks and badge readers of physical access control.
Full entry: applies to, example, limits, 3 controls, 6 related terms, 2 sources
M
- Magnetic Stripe Data
- The full contents of a payment card magnetic stripe, also called full track data or Track 1 and Track 2 data.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 2 sources
- Malware
- Malicious software designed to infiltrate, damage, or compromise a computer system, network, or device without the user's consent.
Full entry: applies to, limits, 6 controls, 5 related terms, 1 source
- Masking
- The process of concealing or obfuscating sensitive information, such as credit card numbers, by replacing it with other characters or symbols.
Full entry: applies to, example, limits, 1 control, 5 related terms, 2 sources
- Media
- Any physical material that can hold data: disks and other electronic storage, removable media such as USB drives and optical discs, backup tapes, and paper reports and receipts.
Full entry: applies to, example, limits, 6 controls, 5 related terms, 2 sources
- Merchant
- A business or organization that accepts payment cards as a form of payment for goods or services.
Full entry: applies to, example, limits, 6 related terms, 3 sources
- Merchant Level
- The tier a payment brand assigns a merchant, which determines how that merchant must validate PCI DSS compliance.
Full entry: applies to, example, limits, 6 related terms, 1 source
- Message Authentication Code (MAC)
- A short piece of information used to authenticate a message and confirm its integrity.
Full entry: applies to, example, limits, 6 related terms, 2 sources
- Monitoring
- The process of continuously observing and analyzing the operation of computer systems, networks, or applications to detect potential security issues or anomalies.
Full entry: applies to, limits, 5 controls, 5 related terms, 1 source
- MOTO (Mail Order/Telephone Order)
- A type of card-not-present transaction where a customer provides their payment card information to a merchant via mail or telephone.Also. MO/TO, Card-not-present order by mail or phone
Full entry: applies to, example, limits, 6 related terms, 3 sources
- MPoC (Mobile Payments on COTS)
- A PCI Security Standards Council standard covering payment acceptance on ordinary mobile devices, including contactless acceptance and PIN entry on the same device.
- Multi-factor Authentication (MFA)
- Authentication requiring evidence from at least two of three separate categories: something the user knows, for example a password; something the user has, for example a token or registered device; and something the user is, for example a biometric.
Full entry: applies to, example, limits, 4 controls, 6 related terms, 2 sources
- Multi-Tenant Service Provider
- A service provider that delivers shared infrastructure or services to multiple customers from a common environment, such as a cloud or hosting platform, a SaaS application or a hosted payment application.
Full entry: applies to, example, limits, 6 related terms, 2 sources
N
- NAT (Network Address Translation)
- A technique used to map one IP address space to another, often used to enable private IP addresses to communicate over the public internet.
Full entry: applies to, example, limits, 1 control, 4 related terms, 2 sources
- Network
- A group of interconnected devices, such as computers, servers, and switches, that facilitate communication and data exchange.
Full entry: applies to, limits, 6 controls, 5 related terms, 1 source
- Network Access Control (NAC)
- A method of deciding which users and devices may connect to a network, and what they may reach once connected, based on identity, role, device state or similar attributes.
Full entry: applies to, example, limits, 1 control, 5 related terms, 2 sources
- Network Connection
- A path, whether physical, logical or virtual, between two devices along which network packets can travel.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 2 sources
- Network Diagram
- A diagram showing the system components in a networked environment and the connections between them.
Full entry: applies to, example, limits, 3 controls, 5 related terms, 2 sources
- Network Security Control (NSC)
- The PCI DSS v4.x term for any technology that enforces network policy between segments, replacing the v3.2.1 wording "firewalls and routers".
Full entry: applies to, example, limits, 8 controls, 6 related terms, 2 sources
- Network Segmentation
- Dividing a network into isolated segments using firewalls, routing controls or equivalent, so traffic between them is controlled rather than unrestricted.Also. Segmentation, Isolation
Full entry: applies to, example, limits, 3 controls, 6 related terms, 2 sources
- Non-console Access
- Any way of operating a system that goes over the network rather than through a keyboard and screen attached to the machine itself.
Full entry: applies to, example, limits, 3 controls, 6 related terms, 2 sources
- Non-Consumer User
- A user who is not a consumer or end customer, typically referring to employees, contractors, or other individuals with access to a company's systems, networks, or data.
- Non-repudiation
- The assurance that a party cannot deny the authenticity of their actions or the validity of a message or transaction.
- Nonce
- A unique, one-time value used in cryptographic operations, such as encryption or authentication, to prevent replay attacks.
- NTP (Network Time Protocol)
- A protocol used to synchronize the clocks of computers and devices over a network.
Full entry: applies to, example, limits, 2 controls, 5 related terms, 2 sources
O
- OAuth
- An open standard for delegated authorisation: it lets a user grant one application limited access to their data held by another, using an access token instead of sharing a password.
- Obfuscation
- Making data or code hard to read without making it unrecoverable: encoding, scrambling, renaming or hiding it so that a casual reader cannot make sense of it, while anyone who knows the method can reverse it.
- One-time Password (OTP)
- A unique, temporary password generated for a single use or session, often used as part of multi-factor authentication to enhance security.
Full entry: applies to, 1 control, 5 related terms, 1 source
- One-way Hash
- A cryptographic function that takes an input and produces a fixed-size output, often referred to as a hash, which is unique for each unique input.
Full entry: applies to, limits, 2 controls, 5 related terms, 1 source
- Open-source Software
- Software whose source code is made available to the public, allowing users to view, modify, and distribute the software.
- Operating System
- The software that manages a computer's hardware and software resources, providing a platform for applications to run.
Full entry: applies to, limits, 4 controls, 5 related terms, 1 source
- Organizational Independence
- A reporting structure in which the person or team assessing an activity has no conflict of interest with the person or team performing it.
Full entry: applies to, example, limits, 4 controls, 6 related terms, 2 sources
- Out-of-band Authentication
- A method of authentication that uses a separate, independent channel or mechanism to verify a user's identity, such as a phone call or text message.
- Outsourcing
- The practice of contracting with a third-party organization to provide services or perform tasks that would otherwise be done in-house.
P
- P2PE (Point-to-Point Encryption)
- A technology that encrypts cardholder data from the point of capture at the merchant until it reaches the payment processor, ensuring that the data remains unreadable even if intercepted.
- PA-DSS (Payment Application Data Security Standard)
- A retired standard that set security requirements for commercially sold payment applications handling cardholder data.
- PAN (Primary Account Number)
- The payment card number, typically 13 to 19 digits, that identifies the issuer and the cardholder account.
Full entry: applies to, example, limits, 4 controls, 6 related terms, 2 sources
- Partial Evaluation
- An evaluation of a payment page that ran and returned results but did not see the whole page: some script bodies were unreadable, a frame could not be inspected, or requests were blocked.
- Password
- A secret combination of characters used to authenticate a user's identity and grant access to a system or account.
Full entry: applies to, example, limits, 8 controls, 6 related terms, 2 sources
- Patch
- A software update that addresses security vulnerabilities, bugs, or other issues.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 2 sources
- Payment Brand
- A card network that operates a payment system and sets the rules merchants and service providers must follow for cards carrying its mark.Also. Participating Payment Brand
Full entry: applies to, example, limits, 1 control, 6 related terms, 2 sources
- Payment Card
- For PCI DSS, any payment card form factor bearing the logo of one of the Council's Participating Payment Brands.Also. Payment Cards
Full entry: applies to, example, limits, 1 control, 6 related terms, 2 sources
- Payment Card Form Factor
- The physical thing a payment card takes the shape of: the plastic card itself, or a device that emulates one to start a transaction, such as a smartphone, a smartwatch, a fitness band, a key tag or a piece of wearable jewellery.
Full entry: applies to, example, limits, 1 control, 5 related terms, 2 sources
- Payment Channel
- A way a merchant accepts payment: card-present, where the card is read at a point of interaction, or card-not-present, which is e-commerce and mail or telephone order.
Full entry: applies to, example, limits, 6 related terms, 2 sources
- Payment Gateway
- A service that passes transaction data from a merchant e-commerce site or point-of-sale system through to a payment processor.
- Payment Page
- The page a cardholder enters card data into, and the unit PCI DSS Requirements 6.4.3 and 11.6.1 are written about.
Full entry: applies to, example, limits, 2 controls, 8 related terms, 2 sources
- Payment Page Script
- Any script that loads and executes in the consumer's browser as part of a payment page, including analytics, tag managers, chat widgets, fonts and third-party libraries as well as the merchant's own code.Also. Payment Page Scripts
Full entry: applies to, example, limits, 1 control, 7 related terms, 3 sources
- Payment Processor
- The entity a merchant, an acquirer or another party engages to handle the mechanics of a card transaction: routing authorisation requests to the payment brand networks and managing clearing and settlement.
Full entry: applies to, example, limits, 6 related terms, 3 sources
- PCI DSS (Payment Card Industry Data Security Standards)
- The Payment Card Industry Data Security Standard, a set of technical and operational requirements applying to every organization that stores, processes or transmits account data, and to any system that could affect the security of that data.
Full entry: applies to, example, limits, 5 controls, 6 related terms, 2 sources
- PCI Forensic Investigator (PFI)
- A company qualified by the PCI Security Standards Council to investigate suspected payment card data compromises.
- PCI SSC (Payment Card Industry Security Standards Council)
- A global forum that was launched in 2006 to manage the ongoing evolution of the Payment Card Industry (PCI) security standards with focus on improving payment security.Also. The Council, PCI Security Standards Council
Full entry: applies to, limits, 1 control, 4 related terms, 3 sources
- Penetration Testing
- A security testing process that simulates real-world attacks on a system or network to identify vulnerabilities and weaknesses.
Full entry: applies to, limits, 6 controls, 5 related terms, 1 source
- Personal Identification Number (PIN)
- A secret numeric code the cardholder enters at a PIN entry device to prove they are entitled to use the card, most often at a point-of-sale terminal or cash machine.
Full entry: applies to, example, limits, 1 control, 5 related terms, 2 sources
- Personnel
- Everyone working for an entity who has security responsibilities for account data or who could affect its security: full-time and part-time employees, temporary staff, contractors and consultants.
Full entry: applies to, example, limits, 4 controls, 6 related terms, 2 sources
- Phishing
- A social engineering attack in which the attacker poses as a trusted party, usually by email or message, to trick a person into revealing credentials or card data or into opening something that runs malicious code.
Full entry: applies to, limits, 2 controls, 5 related terms, 1 source
- Phishing-Resistant Authentication
- Authentication that cannot be defeated by tricking a user into handing over a credential or approving a prompt, because the secret is never disclosed to any party other than the legitimate system, typically through a factor cryptographically bound to that system.
Full entry: applies to, example, limits, 1 control, 6 related terms, 2 sources
- Physical Access Control
- The mechanisms that let only authorised people into a physical space: badge readers, locks, guards, video, and the procedures behind them.
Full entry: applies to, example, limits, 4 controls, 6 related terms, 2 sources
- Physical Security
- The protection of an organization's facilities, assets, and personnel from unauthorized access, damage, or theft.
Full entry: applies to, limits, 1 control, 5 related terms, 1 source
- PIN Block
- The encrypted block that carries a personal identification number between a PIN entry device and the system that verifies it.
Full entry: applies to, example, limits, 1 control, 6 related terms, 2 sources
- PKI (Public Key Infrastructure)
- A system that manages the creation, distribution, and revocation of public key certificates for use in public key cryptography.
- Point of Interaction (POI)
- The device at which a payment card, or a phone or wearable acting as one, is read: a terminal, a PIN pad, an ATM card reader, a fuel dispenser's reader.
Full entry: applies to, example, limits, 5 controls, 6 related terms, 2 sources
- Point of Sale (POS)
- A merchant's checkout system: the till or electronic cash register, the terminal or PIN pad that reads the customer's card, and the software that ties them together to take the payment.
Full entry: applies to, example, limits, 6 related terms, 2 sources
- Port Scanning
- A method of probing a network or system to find which ports are open and which services answer on them.
- Prioritized Approach
- A supporting tool published by the PCI Security Standards Council that sorts PCI DSS requirements into six milestones, ordered so the controls that most reduce breach risk come first, such as removing stored sensitive authentication data before tackling later refinements.
- Privacy
- The protection of an individual's personal information from unauthorized access, use, or disclosure.
- Privilege Escalation
- The process of exploiting a vulnerability or misconfiguration to gain elevated access or privileges on a system or network.
- Privileged User
- Any user account with more than basic access: administrator accounts most obviously, but also accounts that can approve, export, configure or delete beyond what a standard user can.
Full entry: applies to, example, limits, 2 controls, 5 related terms, 2 sources
- Pseudonymization
- The process of replacing sensitive data with non-sensitive substitutes or pseudonyms, in a way that makes it difficult to re-identify the original data.
- PTS (PIN Transaction Security)
- The Council's programme of security requirements and laboratory evaluations for the devices that accept PINs and read cards: PIN entry devices, secure card readers, unattended payment terminals and the hardware security modules behind them.
- Public Key Cryptography
- Cryptography using a pair of keys, one public and one private, so that what one encrypts only the other can decrypt.
Q
- QIR (Qualified Integrator and Reseller)
- A company trained and qualified by the PCI Security Standards Council to install and maintain payment systems for merchants.
Full entry: applies to, example, limits, 6 related terms, 3 sources
- QR Code
- A two-dimensional barcode that can be scanned and read by smartphones or other devices equipped with a QR code reader.
- QSA (Qualified Security Assessor)
- A company qualified by the PCI SSC to perform PCI DSS assessments and produce Reports on Compliance, and the individual employees of such a company who hold the QSA qualification.
Full entry: applies to, example, limits, 6 related terms, 2 sources
- Quality of Service (QoS)
- A set of network techniques that prioritise some traffic over other traffic so that throughput, delay and loss stay within limits for the traffic that matters.
- Quarantine
- The process of isolating potentially malicious or compromised systems, files, or users from a network or system to prevent further damage or data loss.
- Query
- A request for information or data from a database, system, or network.
Full entry: applies to, limits, 1 control, 5 related terms, 1 source
R
- Ransomware
- A type of malicious software that encrypts a victim's files or data, demanding a ransom to restore access.
- RBAC (Role-Based Access Control)
- A way of granting access by assigning users to roles and giving each role the permissions its job needs, rather than granting rights to people one by one.
Full entry: applies to, 1 control, 5 related terms, 1 source
- Real-time Monitoring
- The continuous observation and analysis of a system or network to detect and respond to security events as they occur.
- Red Team
- A group of security professionals that simulate real-world attacks on an organization's systems and networks to identify vulnerabilities and weaknesses.
- Redirect
- A payment integration that sends the cardholder away from the merchant site to a page on the provider domain, where the card data is entered, before returning them afterwards.
Full entry: applies to, example, limits, 2 controls, 5 related terms, 3 sources
- Remote Access
- The ability to access a computer, network, or system from a location other than where the resource is physically located.
Full entry: applies to, example, limits, 4 controls, 6 related terms, 2 sources
- Removable Electronic Media
- Media built to be taken out of one system and carried to another: USB flash drives, external hard drives, optical discs, memory cards.
Full entry: applies to, example, limits, 3 controls, 5 related terms, 2 sources
- Replay Attack
- A type of cyberattack in which an attacker intercepts and retransmits a valid message or session to gain unauthorized access or manipulate the system.
Full entry: applies to, limits, 1 control, 5 related terms, 1 source
- Residual Risk
- The remaining risk after an organization has implemented security controls and measures to mitigate identified risks.
- Response Plan
- The documented plan an entity activates when a security incident is suspected or confirmed: who does what, who is told, and how the payment brands and the acquirer are notified.
- Responsibility Matrix
- The written allocation of each applicable PCI DSS requirement between an entity and its third-party service provider, recording for every requirement whether the provider, the customer, or both are responsible.
Full entry: applies to, example, limits, 4 controls, 4 related terms, 1 source
- Risk
- The potential for loss or harm when a threat exploits a vulnerability, judged by how likely that is and how serious the result would be.
Full entry: applies to, limits, 6 controls, 5 related terms, 1 source
- Risk Assessment
- Working out what needs protecting, what threatens it, and how likely and costly each threat would be, so that controls go where the exposure is greatest.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 2 sources
- Risk Management
- The process of identifying, assessing, and prioritizing risks, as well as implementing appropriate controls and measures to mitigate them.
- Risk Mitigation
- The process of implementing controls and measures to reduce the likelihood or impact of identified risks.
- Risk Ranking
- The severity an organization assigns to a vulnerability in its own environment, which determines how quickly the vulnerability must be fixed.
Full entry: applies to, example, limits, 4 controls, 6 related terms, 2 sources
- RoC (Report on Compliance)
- The full written record of a PCI DSS assessment, produced on the Council's reporting template by a QSA or an Internal Security Assessor.
Full entry: applies to, example, limits, 5 related terms, 2 sources
- Rootkit
- A type of malicious software that hides its presence on a system, often by modifying operating system components or processes.
- Router
- A network device that forwards data packets between computer networks, helping to route traffic between different systems and networks.
Full entry: applies to, limits, 2 controls, 5 related terms, 1 source
- RSA
- A widely-used public key cryptosystem that enables secure data transmission and digital signatures.
Full entry: applies to, example, limits, 6 related terms, 2 sources
- Rule-based Access Control
- An access control model that manages user access to resources and functions based on specific rules or conditions.
- Runtime Application Self-Protection (RASP)
- A security technology that monitors application execution and detects and prevents real-time attacks by analyzing application behavior.
S
- SaaS (Software as a Service)
- A software licensing and delivery model in which applications are provided over the internet, rather than installed locally on individual devices.
- Safe Harbor
- The protection a payment brand may extend to a merchant or service provider that suffers a compromise but can show it was PCI DSS compliant at the time, reducing or waiving the penalties that would otherwise follow.
- Salt
- Random data that is combined with a password or other sensitive information before being hashed, in order to increase the complexity and security of the hash.
- SAQ (Self Assessment Questionnaire)
- A validation document an eligible organization completes itself, rather than engaging an assessor, to record how it meets PCI DSS.
Full entry: applies to, example, limits, 12 related terms, 2 sources
- SAQ A
- The Self-Assessment Questionnaire for card-not-present merchants, e-commerce or mail and telephone order, that have outsourced all account data functions to PCI DSS compliant third parties and neither store, process nor transmit account data on their own systems.
Full entry: applies to, example, limits, 2 controls, 8 related terms, 3 sources
- SAQ A-EP
- The Self-Assessment Questionnaire for e-commerce merchants that outsource payment processing to a PCI DSS compliant third party but whose own website can affect the security of the transaction: a direct post to the provider, a payment form served from the merchant origin, or merchant-controlled scripts able to reach the payment page.
Full entry: applies to, example, limits, 2 controls, 7 related terms, 1 source
- SAQ B
- The Self-Assessment Questionnaire for merchants that take payments only through imprint machines or standalone dial-out terminals with no internet connection, and that store no account data electronically.
- SAQ B-IP
- The Self-Assessment Questionnaire for merchants using standalone, PTS-approved payment terminals with an IP connection to the processor, storing no account data electronically.
- SAQ C
- The Self-Assessment Questionnaire for merchants with a payment application system connected to the internet, where the application is not on the same system as any other system holding account data, and no account data is stored electronically.
- SAQ C-VT
- The Self-Assessment Questionnaire for merchants that key transactions one at a time into a web-based virtual terminal supplied by a PCI DSS compliant third party, using a device isolated from other systems and storing no account data electronically.
- SAQ D
- The catch-all Self-Assessment Questionnaire, published in two versions.
- SAQ P2PE
- The Self-Assessment Questionnaire for merchants using only hardware payment terminals that form part of a PCI SSC listed Point-to-Point Encryption solution, with no account data stored electronically.
- SAQ SPoC
- The Self-Assessment Questionnaire for merchants accepting payments through a commercial off-the-shelf mobile device paired with a secure card reader as part of a PCI SSC listed Software-based PIN entry on COTS solution, storing no account data electronically.
- Scoping
- The process of determining the systems, networks, and components that are in scope for PCI DSS compliance.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 2 sources
- Script Inventory
- The written list of every script permitted on a payment page, each with a justification for its presence, required by Requirement 6.4.3.
Full entry: applies to, example, limits, 1 control, 4 related terms, 1 source
- SDLC (Software Development Life Cycle)
- The process of planning, designing, building, testing, and maintaining software applications.
- Secure Coding
- The practice of developing software applications in a way that reduces the likelihood of security vulnerabilities and risks.
Full entry: applies to, example, limits, 3 controls, 6 related terms, 2 sources
- Secure SLC (Secure Software Lifecycle Standard)
- The half of the PCI Software Security Framework that assesses how a vendor builds software rather than the finished product: threat modelling, secure design, code review, vulnerability management and change control across the development lifecycle.
- Secure Socket Layer (SSL)
- An obsolete cryptographic protocol for securing network communications, superseded by Transport Layer Security (TLS).
Full entry: applies to, example, limits, 1 control, 5 related terms, 2 sources
- Security Event
- An occurrence or activity that indicates a potential threat to the security of an organization's information systems or data.
Full entry: applies to, example, limits, 1 control, 6 related terms, 2 sources
- Security Information and Event Management (SIEM)
- A type of software solution that collects, analyzes, and correlates security event data from various sources, helping organizations detect and respond to security incidents.
- Security Officer
- The person with primary responsibility for an entity's security.Also. Chief Information Security Officer, CISO
Full entry: applies to, example, limits, 2 controls, 5 related terms, 2 sources
- Security Policy
- The documented rules that set out how an organisation protects its information and what its people must do to keep it protected.
Full entry: applies to, limits, 6 controls, 5 related terms, 1 source
- Segmentation
- Isolating the systems that store, process or transmit account data from those that do not, so that the rest of the network falls outside PCI DSS scope.
- Segmentation Penetration Testing
- Testing performed specifically to prove that the controls isolating the cardholder data environment from the rest of the network actually hold, as distinct from a general penetration test of the environment.
Full entry: applies to, example, limits, 3 controls, 4 related terms, 1 source
- Sensitive Area
- A physical area that houses systems critical to the CDE: data centres, server rooms, back-office rooms in shops, anywhere cardholder data storage, processing or transmission is concentrated, and rooms holding the systems that secure the CDE, such as network security controls.
Full entry: applies to, example, limits, 4 controls, 6 related terms, 2 sources
- Sensitive Authentication Data (SAD)
- Security-related information used to authenticate cardholders or authorise transactions: the full contents of any track from the magnetic stripe or chip, the card verification code printed on the card, and PINs and PIN blocks.
Full entry: applies to, example, limits, 6 controls, 6 related terms, 2 sources
- Separation of Duties
- Dividing the steps of a function among more than one person so that no individual can carry the whole thing through alone.Also. Segregation of duties
Full entry: applies to, example, limits, 3 controls, 5 related terms, 2 sources
- Service Code
- A three or four-digit value encoded on the magnetic stripe or chip of a payment card that tells the terminal how the card may be used, such as whether it is valid internationally, whether a PIN is required, and whether the chip must be used in preference to the stripe.
Full entry: applies to, example, limits, 6 related terms, 2 sources
- Service Provider
- A business entity, other than a payment brand, directly involved in processing, storing or transmitting cardholder data on behalf of another entity, or providing services that control or could affect the security of cardholder data.
Full entry: applies to, example, limits, 3 controls, 7 related terms, 2 sources
- Service Provider Level
- The tier a payment brand assigns a service provider, determining how it must validate compliance.
- Significant Change
- A change that could affect the security of the cardholder data environment, which is how PCI DSS v4.0.1 characterises the term.
Full entry: applies to, limits, 6 controls, 5 related terms, 1 source
- Skimming
- Capturing card data by tampering with the physical point of acceptance, using a device fitted over or inside a terminal, ATM or fuel pump to read the magnetic stripe, and often a pinhole camera or overlay keypad to capture the PIN.
Full entry: applies to, example, limits, 4 controls, 6 related terms, 1 source
- SNMP (Simple Network Management Protocol)
- The protocol network devices use to report status and accept configuration from a management system.
Full entry: applies to, example, limits, 3 controls, 5 related terms, 2 sources
- Software Security Framework (SSF)
- The PCI Security Standards Council framework that replaced PA-DSS on 28 October 2022.
- Split Knowledge
- A control in which a cryptographic key is divided into components and no single person holds enough of them to reconstruct the key.
Full entry: applies to, example, limits, 3 controls, 5 related terms, 2 sources
- SPoC (Software-based PIN Entry on COTS)
- A PCI Security Standards Council standard for solutions that accept a PIN on an ordinary commercial off-the-shelf device, such as a phone or tablet, paired with a separate secure card reader that handles the card data.
- SSH (Secure Shell)
- The encrypted protocol used to administer systems over a network: a remote command line, file transfer, and tunnels for other traffic.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 2 sources
- Strong Cryptography
- The Council's threshold for encryption and hashing that counts under PCI DSS: an algorithm the industry has tested and accepts, keys that give at least 112 bits of effective strength (128 recommended for new implementations), and proper key management behind them.
Full entry: applies to, example, limits, 8 controls, 6 related terms, 3 sources
- Subresource Integrity (SRI)
- An HTML attribute that pins a script or stylesheet to a cryptographic hash of its expected contents, so the browser refuses to execute the file if it has been altered.
Full entry: applies to, example, limits, 1 control, 5 related terms, 2 sources
- System Component
- Any network device, server, computing device, virtual component, cloud component or piece of software that sits within the cardholder data environment or is connected to it.Also. System Components
Full entry: applies to, example, limits, 6 controls, 6 related terms, 2 sources
- System-level Object
- Anything on a system component that the system needs in order to run: application and system executables, configuration files, shared libraries, device drivers and their configuration, and third-party components.
Full entry: applies to, example, limits, 2 controls, 5 related terms, 2 sources
T
- Targeted Risk Analysis (TRA)
- A documented risk analysis that PCI DSS v4.x requires in two situations.
Full entry: applies to, example, limits, 2 controls, 4 related terms, 2 sources
- Telnet
- A remote terminal protocol from before encryption was expected, which sends everything, including the login password, across the network in the clear.
Full entry: applies to, example, limits, 3 controls, 5 related terms, 2 sources
- Third-Party Service Provider
- Any third party acting as a service provider on behalf of an entity: a processor, gateway, hosting company, managed security provider, or any other provider that handles account data for the entity or could affect its security.Also. TPSP
Full entry: applies to, example, limits, 5 controls, 5 related terms, 2 sources
- Third-Party Software
- Software an entity acquired rather than had written for it: purchased, open source, freeware or shareware.
Full entry: applies to, example, limits, 3 controls, 6 related terms, 2 sources
- Threat Modeling
- A structured approach to identifying, quantifying, and addressing security threats and vulnerabilities in an organization's information systems.
- Three-Domain Secure (3-D Secure)
- An authentication protocol for online card payments that checks the cardholder with the card issuer before the transaction is authorised.
- Token
- In authentication, a value produced by a hardware device or a piece of software that works with an authentication server or a VPN to prove possession: the something-you-have factor.Also. Authentication token, Hardware token
Full entry: applies to, example, limits, 2 controls, 6 related terms, 2 sources
- Token Service Provider (TSP)
- An entity that generates, issues and manages payment tokens, and maintains the mapping between a token and the underlying primary account number.
- Tokenization
- Replacing a PAN with a surrogate value, the token, that has no value to an attacker and that only the tokenisation system can map back to the PAN.
Full entry: applies to, example, limits, 1 control, 6 related terms, 1 source
- Track Data
- The data encoded in the tracks of a payment card magnetic stripe, or the equivalent data held on a chip.
Full entry: applies to, example, limits, 2 controls, 6 related terms, 2 sources
- Transaction Data
- The record of a payment card transaction: the account data used to pay (PAN, expiry, cardholder name), the amount, date, merchant, the issuer's authorisation result and any reference the processor returns.
- Transaction Identifier (Transaction ID)
- A unique reference number assigned to each payment card transaction, which can be used to trace the transaction through the payment processing system.
- Transport Layer Security (TLS)
- A cryptographic protocol that gives two systems an authenticated, encrypted channel over a network, replacing the older Secure Sockets Layer (SSL) protocol.
Full entry: applies to, example, limits, 1 control, 6 related terms, 2 sources
- Truncation
- Permanently removing part of the primary account number so the full number cannot be recovered from what remains, for example keeping only the first six and last four digits.
Full entry: applies to, example, limits, 2 controls, 5 related terms, 2 sources
- Trusted Network
- A network the entity controls or manages and that meets the PCI DSS requirements that apply to it.
Full entry: applies to, example, limits, 5 controls, 6 related terms, 2 sources
- Trusted Platform Module (TPM)
- A hardware component that provides cryptographic functions and secure storage for sensitive data, such as encryption keys.
- Trusted Third Party (TTP)
- An organization or individual that acts as an impartial intermediary between two or more parties, providing trust services such as identity verification, key management, or cryptographic services.
- Trusted Zone
- A segment of a network or system that is considered secure and protected from unauthorized access.
- Tunneling
- The process of encapsulating one network protocol within another, typically for the purpose of securely transmitting data across a public network.
- Two-Factor Authentication (2FA)
- Multi-factor authentication using exactly two factors. 2FA is a subset of MFA rather than a separate control, and the same rule applies: the two factors must come from different categories, so a password paired with a security question does not qualify.
- Twofish
- A symmetric block cipher with a 128-bit block and keys of 128, 192 or 256 bits, one of the five finalists in the competition that selected AES.
U
- Unified Threat Management (UTM)
- An approach to information security that combines multiple security functions, such as firewall, intrusion detection, and antivirus, into a single solution.
- Unique Identifier (UID)
- A distinct and non-reusable value assigned to a specific entity, such as a user, system, or device, to differentiate it from others.
- Untrusted Network
- A network that is not under the control of the organization and is considered potentially hostile or insecure.
Full entry: applies to, example, limits, 4 controls, 6 related terms, 2 sources
- User Acceptance Testing (UAT)
- A phase of software development where the intended users test the system to ensure it meets their requirements and functions correctly.
- User Account Management
- The process of creating, maintaining, and deleting user accounts, as well as assigning and managing access rights and permissions.
- User and Entity Behavior Analytics (UEBA)
- A security approach that leverages machine learning and advanced analytics to identify anomalous behavior and potential threats by analyzing user and system activity.
- User Identification
- The process of uniquely identifying a user attempting to access a network or system, typically through the use of a username, email address, or other identifier.
Full entry: applies to, limits, 1 control, 5 related terms, 1 source
- User Training and Awareness
- Educating personnel on the security policies and procedures that protect cardholder data, and refreshing that knowledge on a fixed schedule.
- User-Managed Access (UMA)
- A protocol, built on OAuth 2.0, that lets a person decide which third-party applications and services may reach their own data held by a service.
V
- Validation
- The process of confirming that a system, application, or process meets specific requirements, such as security controls or PCI DSS requirements.
Full entry: applies to, limits, 2 controls, 5 related terms, 1 source
- Virtual Local Area Network (VLAN)
- A logical grouping of network devices that can span multiple physical network segments.
- Virtual Machine (VM)
- A software-based emulation of a physical computer system that runs on a host system.
- Virtual Payment Terminal
- A web page, provided by an acquirer, processor or other third party, into which a merchant types a customer's card details by hand to authorise a transaction.
Full entry: applies to, example, limits, 5 related terms, 2 sources
- Virtual Private Network (VPN)
- A secure network connection that uses encryption and tunneling to transmit data between remote users and a private network.
Full entry: applies to, example, limits, 6 related terms, 2 sources
- Virtualization
- The process of creating multiple virtual instances of a computer system, such as a server or desktop, on a single physical hardware platform.
Full entry: applies to, example, limits, 1 control, 5 related terms, 2 sources
- Virus
- A type of malicious software that can replicate itself and spread from one system to another, often causing harm or unauthorized access to data.
- Visitor
- A vendor, a guest of an employee, a service worker, or a member of staff who does not normally have access to the area in question.
Full entry: applies to, example, limits, 3 controls, 5 related terms, 2 sources
- Vulnerability
- A weakness in a system, application, or process that can be exploited by an attacker to gain unauthorized access or cause harm.
Full entry: applies to, example, limits, 6 controls, 6 related terms, 2 sources
- Vulnerability Assessment
- The broader process of identifying vulnerabilities, judging what each one actually means in the context of the environment, ranking them by risk and deciding what to do about them.
- Vulnerability Management
- An ongoing process of identifying, evaluating, and mitigating vulnerabilities in systems and applications to reduce the risk of security incidents.
- Vulnerability Scanning
- The use of automated tools to check systems and networks against a database of known vulnerabilities and misconfigurations.
Full entry: applies to, limits, 5 controls, 5 related terms, 2 sources
W
- Weak Cryptography
- The use of cryptographic algorithms or key lengths that are no longer considered secure due to advances in computing power or the discovery of vulnerabilities.
Full entry: applies to, limits, 1 control, 4 related terms, 2 sources
- Web Application
- An application reached through a browser or through web services, whether over the internet or on a private network.
Full entry: applies to, example, limits, 3 controls, 6 related terms, 2 sources
- Web Application Firewall (WAF)
- A security solution that monitors, filters, and blocks HTTP traffic to and from web applications.
Full entry: applies to, limits, 2 controls, 5 related terms, 1 source
- Whitelisting (Allow List)
- The practice of permitting only explicitly approved entities, such as IP addresses, domains or applications, and denying everything else by default.Also. Allow list, Allowlist, Whitelist
- Wireless Access Point (WAP)
- A networking device that allows wireless devices to connect to a wired network.
Full entry: applies to, limits, 5 controls, 5 related terms, 1 source
- Wireless Intrusion Prevention System (WIPS)
- A security solution designed to detect, prevent, and mitigate unauthorized access or attacks on wireless networks.
- Wireless Local Area Network (WLAN)
- A network that connects devices using wireless communication protocols, such as Wi-Fi.
Full entry: applies to, limits, 4 controls, 5 related terms, 1 source
X
- X.509
- The standard format for digital certificates in a public key infrastructure: it binds a public key to a name and records the issuing certificate authority, validity period and signature, and it is the certificate type TLS uses.
- XSS (Cross-Site Scripting)
- An attack in which a script an attacker chose runs in a victim's browser on a site they trust, because the site reflected or stored the attacker's input as code.
Z
- Zero-Day Vulnerability
- A security flaw in software or hardware that is unknown to the vendor and has not yet been patched.
- Zone-based Firewall
- A type of firewall configuration that segments a network into multiple security zones, each with its own policies and rules.
Full entry: 1 control, 4 related terms, 1 source