PCI DSS Compliance

Best Practice: PCI DSS Compliance

The Payment Card Industry Data Security Standard (PCI DSS) is the global security standard for any organization that stores, processes, or transmits payment card data. It is maintained by the PCI Security Standards Council, founded by the major card brands. Version 4.0 introduced a more outcome-focused, risk-based approach alongside the traditional defined controls. The standard organizes requirements into goals such as building a secure network, protecting cardholder data, managing vulnerabilities, controlling access, monitoring, and maintaining an information security policy. For modernization, PCI DSS scope management is critical: reducing the cardholder data environment (CDE) before and during migration shrinks both risk and audit burden.

Step-by-Step Implementation Guidance

1. Determine your merchant or service-provider level and applicable validation (SAQ or ROC).
2. Define and minimize the cardholder data environment; use tokenization to take systems out of scope.
3. Implement network segmentation to isolate the CDE.
4. Apply the requirement areas: secure configuration, encryption, access control, logging, and vulnerability management.
5. Encrypt cardholder data in transit and at rest, and never store prohibited data such as CVV.
6. Maintain continuous monitoring, logging, and regular testing (scans and penetration tests).
7. Complete the appropriate validation: Self-Assessment Questionnaire or Report on Compliance with a QSA.

Common Mistakes Teams Make When Ignoring This Practice

• Letting cardholder data spread across systems, inflating PCI scope.
• Storing sensitive authentication data such as full track or CVV.
• Treating compliance as annual rather than continuous.
• Weak or missing network segmentation around the CDE.
• Skipping required vulnerability scans and penetration testing.

Tools and Techniques That Support This Practice

• Tokenization and point-to-point encryption to reduce scope.
• Approved Scanning Vendor (ASV) scans and penetration testing.
• File integrity monitoring, SIEM, and centralized logging.
• Network segmentation, WAFs, and strong access control with MFA.

How This Practice Applies to Different Migration Types

• Cloud Migration: Use a PCI-compliant cloud landing zone and re-validate segmentation in the new environment.
• Database Migration: Preserve encryption and tokenization so cardholder data stays protected and minimized.
• SaaS Migration: Offload card handling to PCI-validated payment providers to shrink your scope.
• Codebase Migration: Ensure the new code never logs or stores prohibited data and keeps encryption intact.

Checklist

• Merchant or service-provider level and validation path are known.
• The cardholder data environment is minimized.
• Network segmentation isolates the CDE.
• Cardholder data is encrypted in transit and at rest.
• Prohibited authentication data is never stored.
• Required scans and penetration tests are scheduled.
• The correct SAQ or ROC validation is completed.