PCI DSS defines global technical and operational requirements to protect cardholder data across the payment ecosystem. It applies wherever Primary Account Number (PAN) data is stored, processed, or transmitted, and results in either a Self-Assessment Questionnaire (SAQ) or a formal Report on Compliance (ROC) and Attestation of Compliance (AoC). This standard is applicable to:

• Merchants of any size accepting card payments (in-store, e-commerce, MOTO).
• Payment processors, gateways, hosting providers, and managed service providers.
• Software developers and device manufacturers involved in payment applications.
• Any third party with access to, or that could impact, the Cardholder Data Environment (CDE).

Key Requirements (the 12 PCI controls, simplified):

1. Install/maintain network security controls and segmentation.
2. Apply secure configurations; remove vendor defaults.
3. Protect stored account data (render PAN unreadable; strong key management).
4. Encrypt transmission of cardholder data over open/public networks.
5. Protect systems from malware; keep anti-malware current.
6. Develop and maintain secure systems/software (patching, SDLC).
7. Restrict access to data by business need-to-know.
8. Identify and authenticate users (MFA, strong auth).
9. Restrict physical access to cardholder data.
10. Log and monitor all access to systems and data.
11. Test security regularly (ASV scans, internal/external testing).
12. Govern with security policies, risk management, and ongoing compliance.