What is PCI DSS?

PCI DSS is set by the PCI Security Standards Council, founded by the major card brands. If you take card payments, your acquirer, the bank that processes them for you, expects you to meet it. Its requirements cover how you build and run your systems: secure networks, protecting card data, managing vulnerabilities, controlling access, monitoring and testing, and having a security policy.

An example. A distributor sells online to trade customers, who pay by card at checkout. Card details go into its payment provider's form, so it never stores them. It still completes a self-assessment each year, and still needs to control the scripts on the pages around its checkout, because that's where card-skimming attacks start.

Versions and dates

The current version is PCI DSS v4.0.1. Requirements that v4.0 introduced as "future-dated" became mandatory on 31 March 2025, including two about the scripts on payment pages, 6.4.3 and 11.6.1.

Levels and questionnaires

The card brands place merchants in levels by how many card transactions they handle a year. The largest are usually assessed by a Qualified Security Assessor (QSA), who writes a Report on Compliance. Most other merchants complete a self-assessment questionnaire (SAQ). Which SAQ you use depends on how you take payments: for example, whether card details are entered on your own pages or in your payment provider's iframe or hosted page. Your acquirer decides which applies, and your acquirer or QSA has the final word on whether you comply.

Why it matters

A breach of card data is costly, damages trust and can affect your ability to take card payments. Online, the most common route is card skimming: a malicious script slipped onto a payment page to copy card details as they're typed. Strong sign-in matters too, including multi-factor authentication for anyone with access to your systems.

How we do it

We keep an inventory of every script on your payment pages and watch for changes, as PCI DSS v4.0.1 now requires. We set up your Content Security Policy and integrity checks, and alert you when anything changes, under our ISO 27001 certified controls.