The 12 PCI DSS Requirements, Explained in Plain English
Understanding your PCI DSS requirements is the first step to securing customer payment data and keeping your merchant account in good standing. The payment card industry data security standard is a set of security rules created by the PCI Security Standards Council, founded by the major card brands: Visa, Mastercard, American Express, Discover, and JCB.
The standard applies to any business that accepts, processes, stores, or transmits payment card data. PCI compliance is not a government law in the US. Instead, it is a strict contractual obligation enforced by the card brands through your merchant agreement with your acquiring bank or payment processor. If you ignore these rules, the consequences flow directly through your processor.
Non-compliance risk: card-brand non-compliance assessments passed through your acquirer, and after a card-data breach, an independent forensic investigation that the payment brands may require.
To make compliance manageable and give businesses a clear roadmap, the council organizes the standard into 12 specific rules. For a broader look at how the standard works, read the plain-English PCI overview.
- The PCI DSS 12 Requirements Explained
- Who Must Comply and How to Validate
- What PCI DSS 4.0.1 Changed
- PCI DSS Requirements for Service Providers and Third Parties
- Which Requirements Are it Work vs Policy Work?
- Frequently Asked Questions
- Secure Your Payment Environment with LeadingIT
The PCI DSS 12 Requirements Explained
Whether you are building a PCI DSS requirements checklist or just trying to understand your it scope, you need to know what each rule actually demands. Here is a plain-English breakdown of the PCI DSS 12 requirements.
1. Install and Maintain Network Security Controls
This requirement covers the core PCI DSS network requirements: firewalls, traffic control, and network segmentation. By using firewalls to separate your cardholder data environment from your general business network, you shrink the CDE. A smaller CDE means fewer systems must meet the full standard, which drastically lowers your compliance burden.
Quick actions:
- Control digital traffic entering and leaving your network to prevent unauthorized access.
- Segment your network with firewalls to shrink your CDE.
2. Apply Secure Configurations
You must never keep vendor defaults. Routers, servers, point-of-sale systems, and software packages usually ship with default usernames and passwords that hackers know and exploit routinely.
Quick actions:
- Change all default usernames and passwords immediately.
- Apply secure configurations before any device ever touches your network.
3. Protect Stored Account Data
The golden rule of payment security: if you do not need to store cardholder data, do not store it.
Cardholder data includes:
- Primary account number (PAN)
- Cardholder name
- Expiration date
- Service code
If you must store the PAN, you must render it unreadable using encryption, truncation, or tokenization. More importantly, you may never store sensitive authentication data after authorization is complete, even if it is encrypted:
- CVV/CVC security code
- Full magnetic-stripe or track data
- PINs
4. Protect Cardholder Data with Strong Cryptography
The PCI DSS encryption requirements state that any card data sent across open, public networks must be encrypted using strong cryptography. If cybercriminals intercept the data in transit, they cannot read or use the information.
Quick actions:
- Encrypt card data sent over the internet, email, or wireless networks.
- Use strong cryptography so intercepted data cannot be read or used.
5. Protect All Systems Against Malware
Run active, updated antivirus and anti-malware software on all systems that could be affected by malicious software.
Quick actions:
- Run antivirus/anti-malware continuously and keep virus definitions updated automatically.
- Generate audit logs from your malware protection software.
- Configure the software so normal users cannot disable or bypass it.
6. Develop and Maintain Secure Systems and Software
This requirement is primarily about patch management. Hackers exploit known vulnerabilities in popular software to breach networks.
Quick actions:
- Install vendor security updates promptly when they are released.
- Follow strict secure coding practices for any custom-developed software.
7. Restrict Access by Business Need to Know
Access to cardholder data is strictly limited based on job roles. Only employees who absolutely need the data to perform their specific duties should have access.
Quick actions:
- Document access roles clearly for anyone who touches cardholder data.
- Enforce these restrictions automatically, denying access to everyone else by default.
8. Identify Users and Authenticate Access
Every person with computer access must have a unique ID. You cannot share generic login credentials like “admin” or “register1” among multiple employees. Unique IDs ensure you can trace every digital action back to a specific individual.
Quick actions:
- Assign every user a unique login ID, never a shared generic credential.
- Enforce multi-factor authentication (MFA) for all access into the cardholder data environment.
9. Restrict Physical Access to Cardholder Data
Cybersecurity is not entirely digital. You must physically secure your servers, paper files, and payment terminals.
Quick actions:
- Keep visitors out of sensitive areas and maintain visitor logs.
- Lock up physical records.
- Physically inspect point-of-sale devices regularly for tampering or skimmers.
10. Log and Monitor All Access
The PCI DSS log retention requirements mandate that you track user activities across your network. If a breach happens, forensic investigators need logs to see exactly how the attackers got in, what systems they compromised, and what data they touched.
Quick actions:
- Implement automated audit trails for all system components.
- Review logs frequently to spot suspicious anomalies.
11. Test Security Regularly
Cyber threats evolve daily, so your defenses must be tested regularly.
Quick actions:
- Run quarterly external vulnerability scans through an Approved Scanning Vendor (ASV).
- Complete penetration testing at least annually to find hidden flaws.
12. Maintain an Information Security Policy
Your security efforts must be formally documented.
Quick actions:
- Maintain a written information security policy, reviewed at least annually and distributed to all employees.
- Train staff upon hire and at least annually on protecting cardholder data and recognizing security threats.
Who Must Comply and How to Validate
PCI DSS applies to any organization regardless of size or transaction volume. Visa tiers merchants by annual transaction volume to determine how they must validate their compliance; other card brands set their own similar criteria.
| Level | Annual Transaction Volume | Validation Method |
|---|---|---|
| Level 1 | Over 6 million transactions per year | On-site assessment by a Qualified Security Assessor (QSA), producing a Report on Compliance (ROC) |
| Level 2 | 1 to 6 million transactions per year | Defined by volume; validation not detailed here |
| Level 3 | 20,000 to 1 million e-commerce transactions | Defined by volume; validation not detailed here |
| Level 4 | Fewer than 20,000 e-commerce transactions, or up to 1 million total transactions | Self-Assessment Questionnaire (SAQ), completed annually |
The main SAQ types are:
| SAQ Type | Who it’s For |
|---|---|
| SAQ A | Card-not-present transactions fully outsourced to a validated third party |
| SAQ A-EP | E-commerce sites whose website affects the security of the payment page |
| SAQ B | Imprint machines or standalone dial-out terminals with no electronic storage |
| SAQ B-IP | Standalone IP-connected terminals |
| SAQ C | Payment application systems connected to the internet |
| SAQ C-VT | Manual entry via a virtual terminal |
| SAQ P2PE | Validated point-to-point encryption solutions |
| SAQ D | Everyone else, and service providers (the longest form) |
What PCI DSS 4.0.1 Changed
The PCI Security Standards Council regularly updates the framework to address modern cyber threats. The current version is PCI DSS 4.0.1, which superseded version 4.0.
| Version | Status | Key Changes |
|---|---|---|
| PCI DSS 3.2.1 | Retired (March 31, 2024) | Annual checkbox-style compliance model; narrower MFA and password requirements |
| PCI DSS 4.0 | Introduced, now superseded by 4.0.1 | Shift to continuous security; stricter MFA rules; more rigorous e-commerce payment page testing to prevent digital skimming; modernized password length and complexity standards |
| PCI DSS 4.0.1 | Current version | Supersedes 4.0 with minor corrections; all future-dated requirements from 4.0 became mandatory on March 31, 2025 |
The transition to the PCI DSS 4.0 requirements moved the standard away from a once-a-year compliance exercise and toward ongoing security monitoring throughout the year.
PCI DSS Requirements for Service Providers and Third Parties
The 12 requirements apply to every entity that handles card data, but service providers face additional obligations beyond what a merchant deals with. A service provider is any business that stores, processes, or transmits cardholder data on behalf of another entity, or that can affect the security of another company’s cardholder data environment. This includes payment gateways, hosting providers, managed IT providers, and SaaS platforms that touch payment flows.
How service provider obligations differ from merchant requirements:
- Service providers typically must validate compliance with a Report on Compliance (ROC) completed by a Qualified Security Assessor, not a self-assessment questionnaire. This applies even to smaller providers who would be Level 4 if they were merchants.
- Providers must maintain a written responsibility matrix that spells out exactly which PCI DSS requirements the provider owns versus which the client retains. Every customer relationship needs this documented.
- Annual penetration testing and quarterly vulnerability scans are mandatory for service providers regardless of size.
What this means for businesses hiring third parties:
If your business uses a payment processor, hosting company, or any third party that touches your payment environment, you are still responsible for ensuring that vendor meets PCI DSS. The standard requires you to maintain a list of all service providers you share cardholder data with, have written agreements that acknowledge the provider’s PCI responsibility, and perform due diligence at least annually to confirm the provider remains compliant.
An outsourced provider does not outsource your liability. The merchant agreement is between your business and your acquirer, and non-compliance fees from a third party’s breach flow to you.
Which Requirements Are it Work vs Policy Work?
Meeting your PCI DSS compliance requirements is a shared responsibility. While a managed IT provider handles the heavy technical lifting, compliance also requires internal business policies.
| Requirement | Who Owns it |
|---|---|
| 1. Firewalls and network security controls | IT partner |
| 2. Secure configurations | IT partner |
| 3 & 4. Encrypting stored and transmitted data | IT partner |
| 5. Antivirus and anti-malware | IT partner |
| 6. Software patches | IT partner |
| 7. Business need-to-know access | Business leadership |
| 8. Unique user IDs and MFA | IT partner |
| 9. Physical access to your building and paper files | Business leadership |
| 10. Log monitoring | IT partner |
| 11. Vulnerability scan remediation | IT partner |
| 12. Written information security policy | Business leadership |
Business leadership also owns ensuring staff completes their annual security awareness training.
LeadingIT operates the technical half of PCI compliance as part of our managed IT services. We help you become and stay compliant by managing network segmentation, MFA, patching, and scan remediation. We also help Illinois businesses complete their self-assessments correctly. If you are unsure which form applies to you, check the SAQ decision guide.
See Where You Stand
Take our free 2-minute PCI self-check to answer 8 plain-English questions, discover your risk level, and see the exact gaps you need to fix. There is no sign-up required to see your result. free PCI compliance risk check
Related Guides
- What Is PCI Compliance? A Plain-English Guide
- Which PCI SAQ Do I Need? A 2-Minute Decision Guide
- PCI Compliance Levels 1-4: Which Merchant Level Are You?
- What Is the Cardholder Data Environment (CDE)? PCI Scope
Frequently Asked Questions
What are the 6 major principles of PCI DSS?
The six major principles are to build and maintain a secure network, protect account data, maintain a vulnerability management program, implement strong access control measures, regularly monitor and test networks, and maintain an information security policy.
Is PCI DSS legally required?
PCI compliance is not a government law in the US. It is a contractual obligation enforced by the major card brands through your merchant agreement with your acquiring bank or payment processor. Failing to comply can result in monthly non-compliance fees or losing the ability to accept cards entirely.
What is requirement 5 of PCI DSS?
Requirement 5 mandates that you protect all systems and networks from malicious software. You must install active, continuously running antivirus and anti-malware software on any system that could be affected by malware. These programs must generate audit logs and be protected from user interference.
How often is PCI DSS compliance required?
Compliance is an ongoing process, but formal validation is typically required annually. Most small and mid-size businesses validate their compliance once a year by submitting a Self-Assessment Questionnaire (SAQ) to their payment processor. Some merchant profiles also require quarterly external vulnerability scans.
What are the 12 requirements for PCI DSS compliance?
The 12 requirements include installing firewalls, applying secure configurations, protecting stored account data, encrypting data in transit, using antivirus software, and updating systems regularly. You must also restrict access by need-to-know, authenticate users, restrict physical access, monitor logs, test security, and maintain a security policy.
Can I do PCI compliance myself?
Small businesses can complete the self-assessment forms themselves, but implementing the actual technical controls usually requires it expertise. Setting up network segmentation, configuring firewalls, and managing encryption are complex tasks that most business owners delegate to a managed IT provider.
Do small businesses need to be PCI compliant?
Yes, the standard applies to any business that accepts, processes, stores, or transmits payment card data, regardless of size or transaction volume. Most small businesses fall under Level 4 and validate compliance using an SAQ.
Secure Your Payment Environment with LeadingIT
Meeting the PCI DSS audit requirements and technical controls does not have to drain your time or resources. LeadingIT is a Chicagoland managed it and cybersecurity provider that has helped Illinois businesses since 2010. We serve roughly 200 organizations and 2,500+ users from our offices in Woodstock and Manteno.
While we are not a QSA or ASV, we handle the heavy technical it lifting to help you meet the standard and protect your business from costly breaches. Explore LeadingIT’s PCI compliance services (done-for-you path) to learn how we manage the it side of your compliance.
If you are ready to secure your network, contact us or book a call.
