PCI DSS, the Payment Card Industry Data Security Standard, is the global security framework that governs how any organization storing, processing, or transmitting payment card data must protect that data. It was created in 2006 by the major card brands (Visa, Mastercard, American Express, Discover, and JCB) through the PCI SSC (PCI Security Standards Council), and it applies to every business in the payment chain that touches cardholder data, merchants, processors, gateways, and service providers.
The current version is PCI DSS v4.0.1, which became the sole active version on December 31, 2024, when v3.2.1 was retired. All requirements in v4.0.1, including those originally designated as future-dated best practices when v4.0 was first published in March 2022, became fully mandatory as of March 31, 2025. The standard covers 12 high-level requirement domains, spanning network security, data protection, vulnerability management, access control, monitoring, and security policy.
PCI DSS compliance is validated through a process that depends on the merchant or service provider's transaction volume and business type. Level 1 merchants (the highest volume tier) require an annual on-site assessment by a QSA (Qualified Security Assessor) and quarterly network scans by an Approved Scanning Vendor (ASV). Lower-volume merchants typically validate through a SAQ (Self-Assessment Questionnaire). The completed AOC (Attestation of Compliance) or ROC (Report on Compliance) is submitted to the acquiring bank.
One of the most effective strategies for reducing the cost and complexity of PCI DSS compliance is reducing PCI Scope, minimizing the number of systems and processes that must be assessed by keeping cardholder data out of the merchant's own infrastructure through Tokenization and hosted payment forms. Spreedly operates as a PCI Level 1 Service Provider, enabling merchants to process payments across 120+ gateways while storing all sensitive cardholder data in Spreedly's compliant vault.
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
.svg)
