Payment card fraud and data breaches continue to drive scrutiny of how businesses handle card numbers, and the terminology around that scrutiny trips up a lot of new merchants. “PCI” gets used interchangeably to describe an organization, a technical standard, and a compliance status. Conflating the three leads to confusion about what actually needs to happen before a business can safely accept card payments.
PCI stands for Payment Card Industry. That phrase alone describes an industry, not a rule or a rulebook, so three distinct terms sit underneath it: the Payment Card Industry Security Standards Council (PCI SSC), the organization that writes the rules; the Payment Card Industry Data Security Standard (PCI DSS), the rulebook itself; and PCI compliance, the status a business earns by following that rulebook. This article separates the three so a founder, IT manager, or compliance lead new to payment security can speak about PCI accurately rather than treating it as one vague catch-all term.
What Is PCI SSC?
The Payment Card Industry Security Standards Council is the independent body that writes and maintains payment card security standards. Five card brands founded the Council in 2006: American Express, Discover, JCB International, Mastercard, and Visa. These brands share equally in ownership and governance of the Council's work.
Before the Council existed, each card brand ran its own separate security program. This forced merchants to juggle overlapping and sometimes conflicting rules depending on which cards they accepted. The five brands solved that by forming a single council to produce one consistent standard that applies across all of them.
The Council does not process transactions, fine merchants, or enforce compliance directly. Its job is standard-setting and training: writing the Data Security Standard, qualifying the assessors who audit against it, and publishing supporting guidance. Enforcement sits elsewhere, with the card brands and the banks that process transactions on a merchant's behalf.
What Is PCI DSS?
The Payment Card Industry Data Security Standard is the technical rulebook the Council produces, and it spells out the specific controls a business needs to protect cardholder data. PCI DSS provides a baseline of technical and operational requirements designed to protect account data. Any organization that stores, processes, or transmits payment card numbers falls inside its scope, regardless of size or industry.
The standard has gone through several major revisions since 2006. The current version, 4.0.1, is a maintenance release of the prior version, 4.0, and it did not introduce new or deleted requirements. The Council retired version 4.0 and kept the existing effective date for a set of controls that had previously been treated as optional best practices. Those controls became fully applicable in assessments conducted after that effective date. Every business handling card data should now assume the full standard applies, with no remaining grace period.
What Are PCI Requirements?
PCI requirements are the specific controls spelled out inside PCI DSS, and they remain structurally the same across the recent version updates. The standard lists 12 principal requirements, consisting of detailed security requirements, corresponding testing procedures, and other information pertinent to each requirement. Those 12 requirements group into six broader control objectives:
- Build and maintain a secure network and systems: install and maintain network security controls, and apply secure configurations to all system components
- Protect account data: encrypt and minimize stored cardholder data, and protect it during transmission over open networks
- Maintain a vulnerability management program: protect systems against malware and keep software patched
- Implement strong access control measures: restrict access to cardholder data on a need-to-know basis and control physical access to it
- Regularly monitor and test networks: log and monitor all access to system components and cardholder data, and test the security of systems and networks regularly
- Maintain an information security policy: support information security with organizational policies and programs
These six categories have stayed consistent through the recent version updates, so a business already mapping controls against the older structure does not need to start over. The detail inside several requirements did tighten, though. The update clarified rules around stored authentication data and cryptographic hashing, adjusted language on critical vulnerabilities and payment page scripts, and sharpened expectations for multi-factor authentication and for relationships with third-party service providers.
What Is PCI Compliance, and How Does It Get Validated?
PCI compliance describes the status a business reaches by demonstrating it meets the applicable PCI DSS requirements, validated through a defined process rather than self-declaration alone. The validation method depends on transaction volume rather than being identical across every merchant.
Card brands classify merchants into levels based on how many transactions they process annually, and the levels determine how much proof is required each year.
- Level 1: the highest tier, reserved for the largest processors or any merchant that has already suffered a card-data breach
- Level 2: mid-to-high volume merchants, typically completing a detailed self-assessment with periodic vulnerability scans
- Level 3 and Level 4: lower-volume merchants, generally relying on a shorter self-assessment questionnaire plus scanning
A business exceeding roughly six million transactions a year with a brand qualifies for Level 1. Critically, so does any business that has suffered a breach, regardless of volume. The levels themselves are set by the card brands, not the Council, which writes PCI DSS while Visa, Mastercard, American Express, Discover, and JCB each decide who sits at which level and what they must file. That distinction explains why two companies processing similar volumes sometimes land on different levels depending on which brands they accept.
Validation generally takes one of two forms: a self-assessment questionnaire completed internally, or a formal Report on Compliance completed with help from a Qualified Security Assessor, an individual certified by the Council to perform these audits. Larger merchants and most service providers lean toward the formal audit path, while smaller merchants more often rely on self-assessment paired with periodic scanning.
Is PCI Compliance a Law?
PCI compliance is not a government law, though it functions as a binding requirement in practice. The standard is maintained by the Council and mandated by the major card brands. Compliance is effectively required because payment processors and acquiring banks enforce it as a condition of accepting card payments. A merchant that fails to meet the applicable requirements risks higher processing fees, contract termination by its acquiring bank, or exposure to the full cost of a breach rather than government penalties.
That contractual enforcement model matters for how a business should treat PCI work internally. Skipping it does not trigger a regulator's investigation the way skipping a healthcare privacy rule might, but it can still end a company's ability to accept cards at all. For most SaaS platforms, retailers, or service businesses, that amounts to the same operational risk.
Getting the Terminology Right Is the First Step Toward Compliance
Untangling PCI SSC, PCI DSS, and PCI compliance clears up more than vocabulary. It clarifies who writes the rules, what the rules actually require, and what proof a business owes to the banks and processors that allow it to accept cards in the first place. Businesses that confuse the three terms often misjudge scope, assume a self-assessment covers more than it does, or miss a requirement that quietly became mandatory. Getting clear on the structure first makes the rest of the compliance work far more manageable.
Planet 9 is a Bay Area cybersecurity consulting firm specializing in PCI DSS compliance for SMBs in retail, e-commerce, and payments. Our vCISOs and compliance managers help organizations choose the right approach, configure GRC tools if needed, and get audit-ready without wasted time.
