PCI DSS Compliance: Complete Guide for 2026

PCI DSS certification in the United States refers to the formal validation process that confirms a business complies with the Payment Card Industry Data Security Standard (PCI DSS). Certification is required for organizations that store, process, or transmit cardholder data and is validated through a Self-Assessment Questionnaire (SAQ) or a Qualified Security Assessor (QSA) audit, depending on transaction volume.

If your business accepts credit or debit card payments in the USA, PCI DSS compliance is mandatory under card brand contractual requirements. Created by the PCI Security Standards Council, a group comprising major card brands such as Visa, Mastercard, American Express, JCB, and Discover, the standard sets forth a series of requirements that must be met by any business that processes card payments.

As PCI DSS version 4.0 has moved into required compliance by March 2025, the new standard includes enhanced controls, additional requirements, and a greater focus on ongoing monitoring. In this blog, we are going to explain what PCI DSS is, why it is important for a business in 2025, detail the 12 requirements and control objectives, describe compliance levels and certification processes, describe what is new in PCI DSS 4.0, discuss common issues, and provide best practices for ongoing steady compliance.

What is PCI DSS?

The Payment Card Industry Data Security Standard (PCI DSS) is a globally recognized framework to protect payment card information from theft, fraud, and misuse. It is relevant to any organization that stores, processes, or transmits cardholder data, whether it is a global bank, e-commerce company, or small retailer, service provider, or anywhere a credit card or debit card is swiped. It all comes down to this: if you take credit or debit as a form of payment from your customers or clients for goods or services, you are required to be PCI DSS compliant.

The Payment Card Industry Security Standards Council (PCI SSC) established PCI DSS in 2004. The PCI SSC is an independent organization founded by the five largest card brands - Visa, Mastercard, American Express, JCB, and Discover. These card brands realized that the lack of security best practices resulted in exposed cardholder data and, eventually, created a single global standard for payment security. Although PCI SSC does not have the legal authority to mandate compliance, card brands and acquiring banks require compliance to do business with them, and compliance is believed to be the best method for organizations to protect sensitive information and maintain customer trust in a mutually beneficial manner.

PCI DSS is rather simple in its purpose and mission: to protect cardholder data anywhere it resides - whether it's stored, processed, or transmitted. Requirements around encryption, access controls, network monitoring, and vulnerability management are some of the definitions of the PCI DSS standard. Over the last number of years, PCI DSS has grown in conjunction with increased information security threats, changes in technology, and has become the foundation of a modern payment security strategy.

PCI DSS Certification in the United States

PCI DSS certification in the United States is validated by acquiring banks and card brands such as Visa, Mastercard, American Express, Discover, and JCB. Businesses must demonstrate compliance annually.

Who Needs PCI DSS Certification in the USA?

• E-commerce companies
• Retail merchants
• Financial institutions
• SaaS providers handling payment data
• Service providers with cardholder data access

How to Get PCI DSS Certified in the USA

• Determine your compliance level (Level 1–4)
• Conduct a gap assessment
• Remediate security gaps
• Complete SAQ or QSA audit
• Submit Attestation of Compliance (AOC)
• Perform quarterly ASV scans

Certification is validated through an Approved Scanning Vendor (ASV) and/or a Qualified Security Assessor (QSA), depending on transaction volume.

Why PCI DSS Matters for Business

PCI DSS is not merely a regulatory box to check but a shield for businesses in an increasingly hostile digital environment. The standard’s main aim is to ensure that cardholder data is secure across every stage of its lifecycle to reduce the likelihood of fraud use, data breaches, and unauthorized use. Operations that align with PCI DSS requirements reinforce their defenses against new forms of attack while demonstrating to customers and partners that security is a priority.

1. Enhanced Security

PCI DSS safeguards cardholder data by obligating organizations to comply with a set of proven security practices. This practice will not only defend against data breaches but will foster trust and confidence with customers, resulting in stronger relationships with those customers, repeat business, and ultimately lasting brand loyalty.

2. Trust with Existing and New Customers

Consumers want to do business with organizations that take a proactive approach to data protection. When organizations show compliance with PCI DSS, it demonstrates that an organization is making every effort to earn and maintain trust with its customers. This is especially important in retail, e-commerce, and financial sectors - trust is a key driver of customer loyalty.

3. Mitigating legal risk

Compliance can protect you from some legal risk in the event of a security incident. Complying with PCI DSS, in addition to taking some precautions, can help ensure greater regulatory compliance and avoid litigation and liability in the event of a breach.

4. Financial Protection

PCI DSS compliance can help avoid high costs, like penalties from card networks and banks if PCI DSS is not complied with, as well as repair costs associated with a breach, including remediation and brand damage. Compliance is a financial shield that protects the overall revenue, SCC, and business continuity.

PCI DSS Requirements Explained

The PCI DSS framework consists of 12 primary requirements that are organized into six control objectives. All together, they offer a robust strategy for protecting customer cardholder data from unauthorized access, theft, or misuse. Below is a summary of each of the objectives, with each of the requirements:

Objective 1: Build and Maintain a Secure Network

The first objective addresses the need for organizations to establish a solid foundation for payment security.

• Requirement 1: Install and maintain a firewall configuration to protect cardholder data. Firewalls serve as a barrier between trusted and untrusted networks and stop unauthorized access.
• Requirement 2: Do not use vendor-supplied defaults for system passwords and other security settings. Attackers will often seek out and exploit weak or unchanged defaults.

Objective 2: Protect Cardholder Data

The second objective focuses on protecting sensitive payment data while it is both at rest and in transit.

• Requirement 3: Stored cardholder data must be protected via strong encryption, truncation, masking, or hashing methods. Businesses should only store cardholder data when it is necessary.
• Requirement 4: Cardholder data must be encrypted during transmission across open, public networks. This helps prevent attackers from stealing cardholder data during transmission.

Objective 3: Vulnerability Management

This objective deals with protecting systems from malware and managing timely patches.

• Requirement 5: Use and regularly update anti-virus software or programs, including end-user devices, server devices, and all other system components that may store, transmit, or process cardholder data to protect against malicious software.
• Requirement 6: Develop and maintain secure systems and applications (including applying patches on time and following secure coding guidelines) to create secure systems and applications.

Objective 4: Access Control

Robust access controls ensure that only approved individuals can interact with sensitive cardholder information.

• Requirement 7: Access to cardholder data must be restricted to only those individuals who need access to perform their job responsibilities. Access is to be based on the principle of least privilege.
• Requirement 8: Each individual with access to computers must be assigned a unique identification (ID). This will ensure accountability and tracking of individual activity.
• Requirement 9: Physical access to a computer system accessing cardholder data, including servers and storage, must be restricted to only individuals who need access. Physical security must include data centers and POS systems, including backups.

Objective 5: Monitor & Test Networks

Ongoing monitoring and testing are essential to finding problems before they happen.

• Requirement 10: Organizations must track and monitor all access to network resources and cardholder data with logging and audit trails. Visibility of access to data can assist in identifying suspicious activity.
• Requirement 11: Organizations must regularly test security systems and processes, including vulnerability scans, penetration tests, and incident detection.

Objective 6: Maintain Security Policies

To sum up, the PCI DSS mandates that entities formalize their security practices through policies and training.

• Requirement 12: Keep an information security policy that includes employees, contractors, and third parties. Include providing ongoing security awareness training and updating security policies regularly.

PCI DSS Compliance Levels

Not all businesses process the same volume of card transactions, so PCI DSS employs a tiered model of compliance levels. The level at which an organization is placed depends on how many annual transactions it processes, and in particular, at what level of transactions it expects its compliance validation. Every level sets forth its own validation methodology that can be anywhere from a self-assessment to formally being reviewed via an on-site audit by a Qualified Security Assessor (QSA).

The framework applies to all types of entities that store, process, or transmit cardholder data, no matter if you are a global retailer processing tens of millions of transactions annually, or a small business processing just a few thousand annually.

PCI DSS Compliance Process (How to Get Certified)

Achieving compliance with PCI DSS is not a one-time endeavor; it is an organized, comprehensive, and deliberate approach that requires preparation, validation, and continuous engagement. From an engagement perspective, the journey towards becoming certified generally follows five steps:

PCI DSS Compliance Approach with Identity Governance

Achieving PCI DSS compliance is not just about passing an audit — it requires continuous access control, identity validation, and monitoring.

Organizations must ensure:

• Role-based access control (RBAC)
• Multi-factor authentication (MFA)
• User provisioning and deprovisioning automation
• Audit trail logging
• Quarterly access reviews

Identity governance platforms like Tech Prescient’s Identity Confluence help automate PCI DSS 4.0 access control requirements under Requirement 7, 8, and 10.

PCI DSS 4.0 Transition

As PCI DSS 4.0 has been fully enforced by March 2025, organizations have to fulfill additional requirements for stronger authentication, broader scoping, and continuous monitoring. Businesses that currently hold a PCI DSS 3.2.1 certification will need to revise their controls and policies to comply with PCI DSS version 4.0 before the deadline to maintain compliance.

What Happened to PCI DSS 3.1?

PCI DSS 3.1 was retired and replaced by PCI DSS 3.2.1, which was later succeeded by PCI DSS 4.0. Organizations previously certified under 3.1 must now comply with PCI DSS 4.0 requirements as of March 31, 2025.

Common Challenges and Risks of Non-Compliance

Not adhering to PCI DSS means more than just missing a checkbox; it puts organizations at risk of extremely serious financial, operational, and reputational consequences. This risk is serious enough that even a single error can threaten customer trust and the long-term viability of the organization. What follows are the most critical issues for organizations that fail to meet PCI DSS requirements.

1. High Cost of Breaches and Fines

Compliance breaches leave organizations more exposed to data breaches to steal sensitive cardholder information. The financial costs are exorbitant and as alarming as you can imagine. In addition to the immediate losses of fraud, a business may also incur hefty fines from card brands and acquiring banks. These fines typically vary between thousands and millions of dollars, depending on the non-compliance's degree and length. The average cost of a data breach has risen globally year-on-year, which includes remediation, legal fees, and, in many cases, customer compensation. If you are a small business, even a portion of this cost would be crippling.

2. Operational Disruption

When non-compliance with regulations results in a security event, it can, in turn, result in business disruption well beyond IT. An organization may have to take its systems offline during investigations, creating downtime in payment processing or e-commerce transactions. A business may also face restrictions from payment providers, including higher fees, more audits, or being banned from processing credit card payments entirely. Disruption goes beyond the day-to-day operations and can create far-reaching effects through supply chains and customer service.

3. Loss of Reputation

By far, the most harmful effect of PCI DSS non-compliance is the loss of customer trust. People expect companies to safeguard their payment details. With customer loyalty and trust gone, it can be extremely challenging to rebuild that relationship. Research shows that consumers tend to cease conducting business with an organization that has experienced a breach of payment information. Once a reputation is damaged, it takes a significant investment in public relations, marketing, and more security measures to recover. For many organizations affected by a breach, the pain of a lost reputation continues beyond the financial impact and penalties they face.

PCI DSS 4.0: What’s New?

PCI DSS 4.0, which debuted in March of 2022 with a full transition deadline of March 31, 2025, is the most recent edition of the standard in more than a decade. It is intended to address modern payment security threats, provide organizations with more flexibility to achieve compliance, and emphasize a continuous practice of security as opposed to checkbox compliance with sporadic checks.

Customized Validation Methods

Perhaps the most significant change is the addition of customized validation methods, which help organizations demonstrate security outcomes through alternative controls if traditional methods don’t suit the entity’s environment. This is particularly helpful for complex environments that may be cloud-native or supported by non-hosted services. At the same time, the standard increases expectations for stricter authentication, now requiring multi-factor authentication (MFA) for all access into cardholder data environments, not just for administrative access.

Continuous Monitoring and Testing

A second significant change addresses the emphasis on continuous monitoring and testing. PCI DSS 4.0 demonstrates this shift by requiring organizations to use continuous practices such as automated log reviews, vulnerability scans, and threat detection in place of the annual or semi-annual reviews of the past. As a result, compliance becomes more relevant to real-time security needs than simply a snapshot in time.

In summary, PCI DSS 4.0 emphasizes flexibility and accountability; organizations have more discretion in securing cardholder data, but at the same time, they are held to a higher standard in demonstrating that their security is effective at all times.

PCI DSS Best Practices in 2026

Now that the deadline for moving to PCI DSS 4.0 has passed in March 2025, compliance is no longer simply optional; it’s a base expectation. For organizations handling cardholder data, the situation in late 2025 becomes not merely getting certified, but sustaining the certification through additional cyber threats and regulatory expectations. The following best practices provide assistance to organizations that are engaging in compliance on a continuous basis while providing them with long-term resiliency.

1. Automate Compliance Monitoring

Manual monitoring can be slow, imprecise, and hard to scale. By incorporating automation tools, organizations can reliably monitor ongoing requirements for things like vulnerability management, access reviews, and encryption. Automation makes compliance audit readiness easier, faster, and reduces last-minute anxiety prior to all assessments.

2. Continuous Monitoring and Logging

PCI DSS 4.0 focuses on real-time visibility, making continuous monitoring increasingly important. Organizations should centralize logging capabilities, employ a SIEM tool, and generate automated alerts to detect and respond to anomalies, including unusual access attempts or suspicious data transfers. With the right monitoring technology in place, the regular log reviews, now required in PCI DSS 4.0, become much more effective.

3. Zero Trust Alignment

Zero Trust is a concept quickly becoming an industry standard as a security model. It aligns closely with PCI compliance principles. Enforcing least privilege, requiring strong authentication for every access attempt, and segmenting networks all help mitigate the risk of lateral movement and unauthorized access. Zero Trust not only strengthens compliance but also enhances the overall security posture of the organization.

4. Reduce Data Storage

Organizations should only keep cardholder data that is needed for business to run. Reducing cardholder data of sensitive nature reduces the attack surface you have to support risk analysis and compliance.

5. Creating Strong Policies and Accountability

PCI compliance is accomplished best with strong policies and assigned accountability. Organizations can enforce strong password policies, clearly define roles, and outline goals for compliance. Continuous training on policies and standards establishes awareness to protect cardholder data.

6. Oversight of Third-Party Vendors

In addition to onboarding their employee security standards, all service providers and vendors with access to cardholder data must comply with PCI. Organizations should implement ongoing oversight of their vendors to avoid opening third-party risk in their environment.

7. Security Awareness and Incident Response

Human error and social engineering are still the root cause of breaches. Having continuous training to strengthen employee awareness of phishing, scareware, social-engineering, etc. is necessary. The organization should also maintain an incident response plan that addresses any failures or breaches through detection, containment, and remediation.

8. Continuous Improvement

PCI DSS compliance is not a destination. Organizations should periodically reassess and update their programs, use risk-based methods to focus on the highest priority risks, and, in the event of conditions in their industry or environment that demand higher standards, exceed the PCI DSS controls. If an organization has a QSA (a Qualified Security Assessor) or ASV (an Approved Scanning Vendor) partner, they can provide valuable guidance on long-term compliance.

Ready to Achieve PCI DSS Certification in the United States?

Manual compliance tracking increases audit risk and operational overhead.

With Tech Prescient’s Identity Confluence, you can:

• Automate user access reviews
• Enforce least privilege policies
• Monitor privileged access continuously
• Generate PCI-ready audit reports
• Align with PCI DSS 4.0 continuous monitoring requirements

Next Steps

• Talk to a compliance expert: Explore now
• See it in action: Watch the demo

FAQs

What does PCI DSS stand for?

PCI DSS stands for Payment Card Industry Data Security Standard. It is a global set of security requirements created to protect cardholder data and reduce payment fraud. It was developed by the PCI Security Standards Council (PCI SSC) and applies to any organization that accepts, transmits, or stores payment card transactions.

Who needs to comply with PCI DSS?

Any business that stores, processes, or transmits cardholder data must comply with PCI DSS. This includes retail merchants, online e-commerce sites, financial institutions, service providers, and even small businesses that accept card payments. There are no exceptions related to the size of the business or the average volume of transactions.

What are the 12 requirements of PCI DSS?

The twelve requirements of PCI DSS fall into six different security objectives. These objectives include building and maintaining secure networks, protecting stored and transmitted cardholder data, maintaining a vulnerability management program, implementing robust access controls, monitoring and testing computer networks, and maintaining a security policy. The requirements include practical functions such as firewalls, encryption, anti-virus software, access restrictions, logging activity, and employee training.

What are the 4 PCI DSS compliance levels?

There are four PCI DSS compliance levels determined by the number of transactions a business processes every year. Level 1 is for large companies processing over six million transactions a year, whereas Level 4 is for smaller merchants processing less than 20,000 transactions. Each of the four levels has requirements for validation, from an on-site assessment by a Qualified Security Assessor (QSA) to Self-assessment Questionnaires (SAQ).

Is PCI DSS compliance mandatory by law?

PCI DSS compliance is not a government regulation by itself. It is a contractual requirement of major card brands like Visa, Mastercard, and American Express. Although there is no legal requirement, you will face financial penalties, increased transaction fees, restrictions on your ability to process payments or, in some cases, lose the ability to accept card payments completely. The financial impact is only one aspect of the consequences of not complying with PCI DSS, as a breach can be reputational damage and legal challenges. In practice, this essentially makes complying with PCI DSS mandatory for any business that accepts cardholder data.