In this article
Talk to our experts- PCI DSS
- PCI DSS, the Payment Card Industry Data Security Standard, is a global standard from the PCI Security Standards Council that provides a baseline of technical and operational requirements designed to protect payment account data. It applies to entities that store, process, or transmit cardholder data, including merchants, processors, acquirers, issuers, and service providers.
Also called: Payment Card Industry Data Security Standard
How it works
PCI DSS is the Payment Card Industry Data Security Standard, which defines security requirements to protect environments where payment account data is stored, processed, or transmitted. The PCI Security Standards Council (PCI SSC) says it was developed to encourage and enhance payment card account data security and to facilitate the broad adoption of consistent data security measures globally.
The standard's intended audience is entities that store, process, or transmit cardholder data (CHD) and/or sensitive authentication data (SAD), or could impact the security of the cardholder data environment (CDE). The PCI SSC glossary defines the parties a B2B seller deals with:
- Merchant: any entity that accepts payment cards bearing the logos of any PCI SSC Participating Payment Brand as payment for goods and/or services.
- Service provider: a business entity, other than a payment brand, directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This includes payment gateways and payment service providers (PSPs), and the glossary's examples also include hosting providers.
What counts as cardholder data
PCI DSS protects account data, which the PCI SSC glossary says consists of cardholder data and/or sensitive authentication data:
- Cardholder data: at a minimum, the full PAN, the primary account number that identifies the issuer and the cardholder account. It may also appear as the full PAN plus the cardholder name, expiration date and/or service code.
- Sensitive authentication data: security-related information used to authenticate cardholders and/or authorize payment card transactions, including card verification codes, full track data, PINs, and PIN blocks.
How compliance is shown
PCI DSS assessments are documented in standard reporting tools defined in the PCI SSC glossary:
- Self-Assessment Questionnaire (SAQ): a reporting tool used to document self-assessment results from an entity's PCI DSS assessment.
- Report on Compliance (ROC): a reporting tool used to document detailed results from an entity's PCI DSS assessment.
- Attestation of Compliance (AOC): the official PCI SSC form for merchants and service providers to attest to the results of a PCI DSS assessment, as documented in an SAQ or ROC.
Qualified Security Assessors are independent security organizations qualified by the council to validate an entity's adherence to PCI DSS, and Approved Scanning Vendors conduct external vulnerability scanning. Whether an entity must comply with or validate compliance to a PCI SSC standard is at the discretion of organizations that manage compliance programs, such as a payment brand or acquirer.
Example
A distributor takes card payments from B2B accounts in 2 ways:
- Checkout: a buyer pays by card on the online store, and the card number is handled by the store's payment gateway, which the PCI SSC glossary lists as a service provider.
- Phone order: a rep writes a buyer's card number and security code on a notepad to key in later. That paper now stores cardholder data and sensitive authentication data in the distributor's own office, and PCI DSS is written for entities that store cardholder data.
On Shopify
Shopify says it is certified Level 1 PCI DSS compliant, and that this compliance extends by default to all stores powered by Shopify. It says its certification covers your store, its shopping cart and web hosting, and it describes annual on-site assessments validating compliance.
Shopify's compliance reports in its help center include its PCI Attestation of Compliance, which Shopify reissues after each annual PCI DSS compliance assessment, and its quarterly attestation of Approved Scanning Vendor scan compliance. You'll need to log on to your Shopify account to view the AoC.
How Uncap helps
Uncap's guide to B2B ecommerce payments notes that for merchants using third-party payment gateways, PCI compliance requirements depend on the gateway and integration method. It also explains that a vaulted card is tokenized: Shopify stores a secure token, not the card number.
Sources
Frequently asked questions
What does PCI DSS mean?
PCI DSS stands for Payment Card Industry Data Security Standard. It is the PCI Security Standards Council's global baseline of technical and operational requirements designed to protect payment account data, for entities that store, process, or transmit cardholder data.
Is PCI DSS mandatory?
The PCI Security Standards Council describes its standards as industry-driven, and it says whether an entity is required to comply with or validate compliance to a PCI SSC standard is at the discretion of organizations that manage compliance programs, such as a payment brand or acquirer, so a business should confirm its obligations with the organization that manages its compliance program, such as its acquirer.
What is considered cardholder data?
Under PCI DSS, cardholder data consists at a minimum of the full primary account number (PAN). It may also appear as the full PAN plus the cardholder name, expiration date and/or service code. Card verification codes and PINs are sensitive authentication data, a separate category.
