System Certification

Payment Card Industry Data Security Standard (PCI DSS)

Achieve, validate, and maintain payment security with confidence.

Meet PCI DSS requirements and help protect revenue, reputation, and customer trust

Processing payment card data comes with significant responsibility.

As cyber threats evolve, organizations need to do more than achieve compliance. They must demonstrate that payment data is protected.

With more than two billion daily card transactions processed globally, a security incident can disrupt operations, damage customer trust, and put payment processing at risk.

PCI DSS helps strengthen security and demonstrate that payment card data is handled securely, supporting compliance and business continuity.

Get started

Our Solutions

Manage payment card information securely

Whether you’re preparing for your first assessment or maintaining compliance, we help you navigate complexity and demonstrate compliance.

Training

Understand

Build your knowledge of PCI DSS with expert-led training that helps you understand requirements, scope, and your role in achieving compliance.

See the courses

Pre-Assessment

Prepare

Identify gaps early and define your scope with a structured pre-assessment to prepare your organization for a smooth PCI DSS audit.

Get started

Assessment

Demonstrate compliance

Validate your compliance with a formal QSA led assessment. Upon a successful assessment, you will receive an ROC and signed AOC.

Get started

Why demonstrating PCI DSS compliance matters

Demonstrate PCI DSS compliance to meet payment provider requirements, validate security controls, and protect cardholder data.

Meet payment card provider and acquiring bank expectations for PCI DSS compliance.
Provide recognized evidence of compliance through ROC and AOC documentation, where required.
Reduce the risk of cardholder data compromise and payment fraud.
Protect against financial and reputational damage.
Demonstrate resilience and inspire trust in your organization.

Building Trust

Need to demonstrate PCI DSS compliance? Talk to our QSA experts

Our QSA-led, PCI DSS assessment services help you demonstrate compliance, reduce risk, and deliver trusted validation.

Let’s get started

FAQ

Frequently Asked Questions

Find answers about PCI DSS requirements, compliance validation, and how you can demonstrate payment card data security.

PCI DSS (Payment Card Industry Data Security Standard) is a global payment card data security standard that organizations must follow when they store, process, transmit, or can impact cardholder data.

Managed by the PCI Security Standards Council (PCI SSC) *, PCI DSS helps you protect cardholder data and reduce the risk of payment fraud. It sets out technical and operational requirements for any organization that stores, processes, or transmits payment card information.

By meeting PCI DSS requirements, you strengthen your security, demonstrate trust to customers, and meet the expectations of payment brands and acquiring banks.

*PCI SSC manages the standard, but each card brand maintains their own compliance enforcement programs.
PCI DSS has six main goals that are aligned to security best practices. The requirements of the standard help organizations to decrease brand and financial risks associated with account payment data compromises.

The six goals* include:

Build and maintain a secure network

Protect cardholder data

Maintain a vulnerability management program

Implement strong access control measures

Regularly monitor and test networks

Maintain an information security policy

Source: https://www.pcisecuritystandards.org/standards/pci-dss
While the PCI Security Standards Council (PCI SSC) manages the PCI DSS standard, compliance is determined and enforced directly by the payment card brands and your acquiring bank.

This means organizations may need to validate PCI DSS compliance to continue meeting the requirements of the payment ecosystem and the stakeholders they serve.
If your organization handles payment card data, PCI DSS likely applies. Compliance may be required by your acquiring bank, payment card brands, customers, or contractual obligations as a condition of processing or supporting card payments.

You must comply with PCI DSS if your organization:

Accepts payment cards in any form (in person, online, mobile, or by phone)

Stores or processes cardholder data

Transmits card data to a payment processor

Provides services that could affect the security of cardholder data, even if you never access the data directly

If payment card data touches your systems, or your services could impact its security, PCI DSS applies.
Your role determines how you validate compliance. Understanding your role helps you meet the right PCI DSS requirements.

Merchant: You are a merchant if you sell goods or services and accept payment cards (e.g., retail, e commerce, hospitality). Merchants are broken down into four levels based on the volume of their transactions annually.

Service Provider: You are a service provider if you store, process, transmit, or can impact cardholder data on behalf of another organization (e.g., hosting, cloud, payment gateways).

Both roles are broken down into tiers based on volume of transactions. The tiers determine the specific PCI DSS requirements for compliance.
For organizations that must demonstrate third party validation of their compliance and complete a formal Report on Compliance (ROC), the assessment must be performed by a Qualified Security Assessor (QSA) or by an Internal Security Assessor (ISA) program participant under the oversight of the acquiring bank and relevant card brands.

BSI's experienced QSA team can help you prepare for assessment, validate compliance against PCI DSS requirements, and provide the independent assessment needed to support an ROC and AOC where required.
PCI DSS requires annual assessments at a minimum, with quarterly activities such as vulnerability scans and often penetration testing at defined intervals. These requirements vary based on transaction volumes.

To remain aligned with the PCI DSS standard and support PCI compliance, you should repeat an assessment whenever there are significant changes to the cardholder data environment.
A Report on Compliance (ROC) is an output from your PCI DSS assessment. It is provided by the QSA and details the assessment findings.

An Attestation of Compliance (AOC) is an official document that confirms you have been assessed against PCI DSS and meet the required controls. It is what would be used to share with your stakeholders to validate your compliance.
A Report on Compliance (ROC) is considered the highest form of security validation and is required for Level 1 Merchants and Service Providers who want to demonstrate PCI DSS compliance.

An AOC must be completed by all merchants and service providers required to validate PCI DSS compliance. However, only those with larger volumes of transactions (Level 1 Merchants and Service Providers) are required to have their AOC signed by a Qualified Security Assessor (QSA) following the completion of their assessment.

The AOC is typically required by:

Acquiring banks

Payment brands

Large customers seeking third party assurance

Procurement and vendor risk teams
For organizations who require a ROC to demonstrate compliance, you typically would:

Determine your scope: Identify all systems, networks, and processes that store, process, transmit cardholder data, or that could impact its security.

Assess gaps: Evaluate current controls against PCI DSS requirements to identify gaps or remediation needs.

Remediate security gaps: Implement updates to policies, processes, technology, and documentation to achieve compliance.

Undergo the formal assessment: Conducted by a QSA. An ROC is an output of the assessment that details the findings.

Submit the AOC: After assessment, the AOC is completed and signed. It is then submitted to your acquiring bank, payment brand, or customer as required.
The AOC process time depends on your organization’s size, complexity, and readiness. Key factors include the:

Number of systems in scope

Maturity of existing security controls

Whether ROC or SAQ is required

Amount of remediation needed before assessment

If you already have strong controls in place, you can move more quickly than organizations starting from scratch.