# PCI

- Source: https://support.icompaas.com/support/solutions/articles/62000225196-pci
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CyberSecurity Taxonomy](https://support.icompaas.com/support/solutions/62000112345) › [CyberSecurity-Topics](https://support.icompaas.com/support/solutions/folders/62000168169)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Security

  

  

  

Payment card industry (PCI) compliance is mandated by credit card companies to help ensure the security of credit card transactions in the payments industry. Payment card industry compliance refers to the technical and operational standards that businesses follow to secure and protect credit card data provided by cardholders and transmitted through card processing transactions. PCI standards for compliance are developed and managed by the PCI Security Standards Council.

-   Companies that follow and achieve the Payment Card Industry Data Security Standards (PCI DSS) are considered to be PCI compliant.
    
-   The PCI Security Standards Council is responsible for developing the PCI DSS.
    
-   PCI DSS has 12 key requirements, 78 base requirements, and 400 test procedures to ensure that organizations are PCI compliant.
    
-   Being PCI compliant reduces data breaches, protects the data of cardholders, avoids fines, and improves brand reputation.
    
-   PCI compliance is not required by law but is considered mandatory through court precedent.
    

  

## Requirements for PCI Compliance

PCI compliance standards require merchants and other businesses to handle credit card information in a secure manner that helps reduce the likelihood that cardholders would have sensitive financial account information stolen. If merchants do not handle credit card information according to PCI Standards, the card information could be hacked and used for a multitude of fraudulent actions. Additionally, sensitive information about the cardholder could be used in identity fraud.

Being PCI compliant means consistently adhering to a set of guidelines set forth by the PCI Standards Council. PCI compliance is governed by the PCI Standards Council, an organization formed in 2006 for the purpose of managing the security of credit cards.

The requirements developed by the Council are known as the Payment Card Industry Data Security Standards (PCI DSS). PCI DSS has 12 key requirements, 78 base requirements, and over 400 test procedures. The guidelines are also considered security best practices. Its 12 major requirements include the following:

1.  Implement firewalls to protect data
    
2.  Appropriate password protection
    
3.  Protect cardholder data
    
4.  Encryption of transmitted cardholder data
    
5.  Utilize antivirus software
    
6.  Update software and maintain security systems
    
7.  Restrict access to cardholder data
    
8.  Unique IDs assigned to those with access to data
    
9.  Restrict physical access to data
    
10.  Create and monitor access logs
     
11.  Test security systems on a regular basis
     
12.  Create a policy that is documented and that can be followed
     

  

  

##  PCI compliant

To become PCI compliant, you must first determine which self-assessment questionnaire you need to follow to become compliant. Once you finish the questionnaire, then you need to complete and hold evidence of a passing vulnerability scan with a PCI SSC Approved Scanning Vendor. Scanning applies to only some merchants. You will then need to complete the Attestation of compliance. The last step will be to submit all of the above information.

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.