PCI compliance means meeting the Payment Card Industry Data Security Standard (PCI DSS), the security rules every organization that stores, processes, or transmits payment card data must follow. The standard is set by the PCI Security Standards Council and enforced through card brands and acquiring banks, not by law. The current version, PCI DSS v4.0.1, has 12 core requirements, and all of its new requirements became mandatory on March 31, 2025.
This guide covers what PCI compliance is, the 12 requirements, compliance levels, the groups involved, costs, pros and cons, a checklist, and tips for staying compliant.
What Is PCI Compliance?
PCI compliance is adherence to PCI DSS, a set of technical and operational requirements designed to protect cardholder data. It applies to any organization that accepts, processes, stores, or transmits card payments, including medical practices, schools, manufacturers, distributors, nonprofits, and service providers, regardless of size.
The PCI Security Standards Council (PCI SSC) was founded in 2006 by American Express, Discover, JCB International, Mastercard, and Visa to manage the standard. The card brands and acquirers decide who must validate compliance and what happens if they don’t.
Understanding the Current State of PCI Compliance
PCI DSS is not a federal law; it is a contractual requirement in your merchant agreement. Several states reference it in data security laws, and regulators such as the FTC can take action against companies with unreasonable data security practices. Non-compliance can therefore have both contractual and legal consequences.
PCI DSS v4.0 was published in March 2022, the first major update in over a decade. A limited revision, v4.0.1, was published in June 2024, and v4.0 was retired on December 31, 2024, making v4.0.1 the only active version. Of the 64 new requirements in v4.x, 51 were future-dated and became mandatory on March 31, 2025, according to the PCI SSC. Key changes include MFA for all access to the cardholder data environment, protection of payment pages against script attacks, authenticated vulnerability scanning, targeted risk analyses, and annual scope confirmation.
PCI Compliance Requirements
PCI DSS v4.0.1 is organized into six goals and 12 principal requirements, each with many sub-requirements and testing procedures.
How to Become PCI Compliant
To become compliant, you must meet these 12 requirements:
- Install and maintain network security controls (firewalls and equivalent controls).
- Apply secure configurations to all system components (no vendor defaults).
- Protect stored account data (minimize storage; render card numbers unreadable).
- Protect cardholder data with strong cryptography during transmission over open, public networks.
- Protect all systems and networks from malicious software.
- Develop and maintain secure systems and software, including timely patching.
- Restrict access to system components and cardholder data by business need to know.
- Identify users and authenticate access, including MFA.
- Restrict physical access to cardholder data.
- Log and monitor all access to system components and cardholder data.
- Test the security of systems and networks regularly (scans and penetration tests).
- Support information security with organizational policies and programs, including training and incident response.
Compliance is validated every year through a self-assessment questionnaire (SAQ) or an assessment by a Qualified Security Assessor (QSA), depending on your level and payment setup, plus quarterly external vulnerability scans by an Approved Scanning Vendor (ASV) where required.
The Benefits of PCI Compliance
Secure Systems
The PCI DSS controls are proven security practices that protect your systems and give customers confidence that their card data is safe.
Improved Reputation
Compliance builds trust with customers, partners, and payment brands, and is often required to win contracts with larger organizations.
Contributing to a Global Cause
Every compliant organization helps reduce card fraud across the global payment ecosystem.
Increased Security
Many PCI controls overlap with other frameworks, so compliance makes it easier to meet HIPAA, CMMC, and cyber insurance requirements. See what HIPAA compliance is and what CMMC is for comparison.
The Cons of PCI Compliance
Compliance takes time, money, and ongoing effort, especially for organizations that store card data or run their own payment systems. But the consequences of not meeting PCI requirements are far more costly:
Damaged Reputation
A card data breach erodes customer and partner trust, often for years.
Potential Data Breaches
The global average cost of a data breach reached a record $4.99 million in 2026, and $11.5 million in the U.S., according to the IBM Cost of a Data Breach Report 2026. Card data breaches also bring forensic investigation costs and card reissuance assessments.
Fines, Lawsuits, and Insurance Claims
Card brands can fine acquiring banks for non-compliance, and acquirers pass those fines and higher fees to merchants, or terminate the merchant account. Breaches can also lead to lawsuits and cyber insurance disputes if required controls were missing.
PCI Compliance Levels
Your validation requirements depend on your annual transaction volume. Each card brand sets its own levels; Visa’s merchant levels are commonly used:
| PCI compliance level | Who it applies to (Visa) | Typical validation |
|---|---|---|
| Level 1 | More than 6 million Visa transactions per year (or any merchant that suffered a breach) | Annual on-site assessment by a QSA (Report on Compliance) and quarterly ASV scans |
| Level 2 | 1 million to 6 million transactions per year | Annual SAQ (some acquirers require a QSA) and quarterly ASV scans |
| Level 3 | 20,000 to 1 million e-commerce transactions per year | Annual SAQ and quarterly ASV scans |
| Level 4 | Fewer than 20,000 e-commerce transactions, or up to 1 million other transactions per year | Annual SAQ and ASV scans as required by your acquirer |
The PCI SSC provides self-assessment questionnaires and merchant resources. Your acquirer confirms which SAQ type and validation steps apply to you.
Groups Involved in PCI Compliance
Card Networks
Card brands such as Visa and Mastercard run their own compliance programs, define merchant levels, and set penalties, all based on PCI DSS.
The PCI Security Standards Council
The council develops and maintains PCI DSS and related standards, and trains and qualifies assessors (QSAs) and scanning vendors (ASVs). It does not enforce compliance.
Acquiring Banks and Payment Service Providers
Your acquirer or payment processor requires compliance in your merchant agreement, tells you which SAQ to complete, and may offer compliance tools.
Business Owners
Merchants are responsible for meeting the requirements that apply to them and for managing service providers that touch card data. Failure can mean extra fees, fines, or loss of your merchant account.
How Much Does PCI Compliance Cost?
Costs vary widely with your level and how you accept payments:
- Processor fees: some processors charge monthly or annual PCI program fees, plus a higher non-compliance fee if you don’t submit your SAQ. Check your statement.
- Scanning: quarterly ASV scans for internet-facing systems.
- Remediation: firewalls, MFA, logging, patching, and segmentation to close gaps.
- Assessment: Level 1 organizations pay for an annual QSA assessment; smaller organizations may hire a consultant to help with the SAQ.
The cheapest path is to reduce scope: use validated point-to-point encryption (P2PE) terminals and hosted payment pages so card data never touches your systems.
PCI Compliance Checklist
- Understand your current and future needs
- Map where card data enters, flows, and is stored.
- Determine your merchant level and SAQ type.
- Talk to your payment processor to
- Confirm the PCI requirements in your contract.
- Find out if you are paying PCI or non-compliance fees.
- Ask about scope-reducing options such as P2PE and tokenization.
- Close the gaps
- Implement MFA, network segmentation, logging, patching, and malware protection.
- Schedule quarterly ASV scans and annual penetration tests where required.
- Talk to a PCI compliance expert to design, implement, and document controls.
Tips to Achieve PCI Compliance
Step 1: Follow Data Hygiene Best Practices
- Use strong, unique passwords and MFA everywhere.
- Keep hardware and software updated.
- Don’t store card data you don’t need; never store CVV codes.
- Train staff to spot phishing and smishing.
- Use PCI-validated payment terminals and software.
Step 2: Take Paperwork Seriously
Answer every SAQ question accurately. Checking “yes” without verifying is risky: if a breach occurs, inaccurate attestations can increase penalties and liability. Ask your processor or a qualified advisor when unsure.
Use the Right Systems to Make PCI Compliance Easier
Integrated, validated payment systems, where the processor handles card data through P2PE terminals or hosted payment pages, can dramatically reduce your PCI scope and maintenance burden. Cobbling together products from many providers leaves gaps and puts more responsibility on your team.
Key Takeaways
- PCI compliance means meeting PCI DSS, managed by the PCI Security Standards Council and enforced by card brands and acquirers.
- PCI DSS v4.0.1 is the current version; its 12 requirements and all future-dated controls are mandatory as of March 31, 2025.
- Validation depends on your merchant level: SAQ or QSA assessment, plus ASV scans.
- Reducing scope is the most effective way to lower cost and risk.
Looking for a PCI Compliance Service Provider?
BTI Communications Group has been in business for 40 years and helps organizations implement the network security, MFA, logging, monitoring, and segmentation controls PCI DSS requires. Our cybersecurity services Los Angeles team provides 24/7 monitoring with enterprise-grade security partners, and our managed IT team keeps systems patched and documented for your assessment.
Frequently Asked Questions
What is PCI compliance?
Meeting the Payment Card Industry Data Security Standard (PCI DSS), required for any organization that stores, processes, or transmits payment card data.
Is PCI compliance required by law?
Not federal law. It is required by card brands through your merchant agreement, and some state laws reference it. Non-compliance can lead to fines, higher fees, or loss of card acceptance.
What is the current version of PCI DSS?
PCI DSS v4.0.1, published in June 2024. v4.0 was retired on December 31, 2024, and all future-dated requirements became mandatory on March 31, 2025.
What are the 4 PCI compliance levels?
Based on Visa’s program: Level 1 (over 6 million transactions a year), Level 2 (1 to 6 million), Level 3 (20,000 to 1 million e-commerce), and Level 4 (fewer than 20,000 e-commerce or up to 1 million total).
Get a free IT and cyber risk assessment
See where your network, backups, and security controls stand today. BTI delivers an itemized findings report with prioritized fixes and fixed-cost options. Call 800-435-7284 or request your assessment online.
