PCI DSS: What It Is and What It Isn't

What PCI Isn't

Let’s dig in. PCI is not easy, but it can be made significantly easier with the right configuration and tuning of your PCI compliance environment. Through the use of scope reduction techniques such as network segmentation and better tokenization of the payment card.

PCI DSS compliance is not a guarantee against a breach. An assessment evaluates the applicable requirements and evidence for its scope; maintaining those controls and responding to changing risks is ongoing work.

PCI is not optional, but you can offload some of the burden to PCI compliant third parties and greatly reduce your PCI headache. You can’t outsource responsibility as the old adage goes, but picking a PCI compliant third party who specializes in PCI and securing payment cards is often the right way to go.

What PCI Is

Now that we’ve talked about what PCI is not, let’s talk about what it is. The Payment Card Industry Data Security Standard (PCI DSS) is a solid, comprehensive security standard that applies to all organizations who store, process, or transmit payment card information. There are lots of PCI specific terms and a whole lot of requirements. You can read all about it at the PCI Council Website: https://www.pcisecuritystandards.org/. However, if you are like most – you’ll still have questions. The website does have a list of frequently asked questions, which makes securing the services of a security professional experienced in PCI extremely important.

A PCI assessment is daunting. It is an open book test that is hard to pass. PCI is not very forgiving in terms of the requirements you can fail during an assessment. You have to pass them all - though compensating controls can be applied in some cases. PCI doesn’t really allow you to do much risk acceptance either.

PCI is not optional if you store, process, or transmit payment card data

Core Requirements for PCI DSS

Let’s break down the core requirements for PCI DSS that result in PCI Compliance:

• Design, construct and maintain a secure network and systems, including installation of a firewall between wireless network and cardholder data environment
• Protect cardholder data
• Implement and maintain a strong vulnerability management program
• Introduce and execute solid access control measures
• Regularly monitor and test networks
• Develop and maintain information security policy and ensure proper distribution via training sessions and manuals

While these don’t sound so bad and you are probably thinking to yourself - I already do most of these. These PCI requirements have many sub requirements that total to nearly 300 individual control points you must meet (depending on your configuration). PCI requires documentation supporting the requirements (policies, procedures, or standards) and you will also be required to produce the actual configurations to show you meet the requirements.

Confirm the required internal and external vulnerability scans and penetration tests for your scope. ASV scanning and penetration testing are different activities. Required scans must cover the relevant in-scope assets and be followed through remediation and rescanning.

Use the current PCI DSS testing requirements and applicable validation guidance. Internal and external penetration tests, segmentation testing, and public-facing application protection have distinct requirements. Frequency and applicability depend on the requirement and organization type; do not assume every segmentation test is universally due every six months.

PCI also requires the basic blocking and tackling of information security that you are already doing (or should be) such as user provisioning / deprovisioning, anti-virus protection, patching, configuration hardening, and security awareness training to name a few. Though you may do those basics – you’ll have to have a process in place that provides enough evidence for your PCI Assessor to follow and audit.

Part of the difficulty in PCI is interpreting the requirement. I mentioned it’s an open book test and it is, but you will probably find yourself struggling to interpret the questions. Organizations struggling with PCI Compliance and those who have been asked to comply by banks or customers (especially the first time through) would do well to engage the services of a competent PCI professional.

If you’d like to continue the discussion, please contact me at mark.keppler@sevn-x.com.

Current application protection: PCI DSS v4.x requirement 6.4.2 became effective March 31, 2025. The former choice between periodic application assessment and an automated protection solution is superseded; this does not remove separate penetration-testing obligations.