PCI DSS: What It Is and How Purplecop Helps

What is PCI DSS?

PCI DSS is a standard from the PCI Security Standards Council that provides a baseline of technical and operational requirements designed to protect payment account data.

The Council was founded in 2006 by five payment card brands, and each of them incorporates PCI DSS into the technical requirements of its own data security compliance program. The Council says it does not enforce compliance.

Who needs to comply with PCI DSS?

PCI DSS is intended for entities that store, process or transmit cardholder data (CHD) or sensitive authentication data (SAD), or that could affect the security of the cardholder data environment (CDE). The Council says this includes merchants, processors, acquirers, issuers and service providers.

Whether an entity must comply, or validate compliance, is "at the discretion of organizations that manage compliance programs, such as a payment brand, acquirer, or other entity." The Council adds: "The Council's role is to develop and maintain standards. We do not monitor the implementation of standards." Ask your acquirer or payment brand what applies to you.

What is the current version of PCI DSS?

The current version is PCI DSS v4.0.1. The PCI SSC Document Library listed it as the current, non-archived version, dated June 11, 2024, when we read it on October 24, 2026. Check the library for the version in force before any assessment.

Key dates from the Council:

• v4.0: published March 31, 2022, replacing v3.2.1.
• v4.0.1: a limited revision published June 11, 2024, with corrections and clarifications and, in the Council's words, "no additional or deleted requirements."
• v4.0 retirement: the Council announced v4.0 would be retired on December 31, 2024, leaving v4.0.1 as the only active version. The library lists v4.0 and v3.2.1 as archived.
• Future-dated requirements: the Council says these are best practices until their date, then become effective and applicable. The date it gave for the new v4.x requirements was March 31, 2025, and v4.0.1 did not change it.

What does PCI DSS require?

PCI DSS has twelve principal requirements, with testing procedures that clarify the level of validation expected for each. The Council's v4.0 documents describe several of their focus areas:

• Requirement 1: network security controls, a term that replaced "firewalls" and "routers" to cover a broader range of technologies.
• Requirement 3: account data.
• Requirement 4: strong cryptography to protect transmissions of cardholder data.
• Requirement 6: software. The title now says "software" rather than "applications."
• Requirement 8: v4.0 expanded it to require multi-factor authentication (MFA) for all access into the cardholder data environment. The Council's v4.0.1 announcement adds an applicability note that MFA for all (non-administrative) access into the CDE does not apply to user accounts that are only authenticated with phishing-resistant authentication factors.
• Requirement 10: audit logs, system components and cardholder data.
• Requirement 12: organizational policies and programs that support information security.

How is PCI DSS compliance validated?

Validation can be evidenced, for example, through a Report on Compliance (ROC) or a Self-Assessment Questionnaire (SAQ). The Council's FAQ says "compliance-accepting entities," typically payment brands and acquirers, determine which applies to their merchants and service providers.

Two roles matter:

• Qualified Security Assessors (QSAs) are independent security organizations qualified and trained by PCI SSC to perform PCI DSS assessments. The assessor is responsible for validating that the scope of the assessment, and which requirements apply, are accurately defined and documented.
• Approved Scanning Vendors (ASVs) are qualified and trained by PCI SSC to run external vulnerability scanning services in line with the applicable PCI DSS requirement.

How is PCI DSS different from ISO 27001 and SOC 2?

They differ in who sets them, what they cover and how they are evidenced:

• PCI DSS is a standard of requirements to protect payment account data, maintained by the PCI Security Standards Council. How it is validated is determined by compliance-accepting entities, typically payment brands and acquirers, for example through a ROC or SAQ.
• ISO/IEC 27001 defines requirements for an information security management system. ISO does not issue certificates; external certification bodies do.
• SOC 2 is an assurance report from a CPA, based on AICPA's SOC offerings.

Where do I get the PCI DSS standard, and what does an assessment cost?

The PCI SSC Document Library lists the PCI DSS standard under a license agreement. Read the agreement on the Council's site for the terms of use.

The Council does not publish assessment or scanning fees in the pages we read. The Council describes Qualified Security Assessors as independent security organizations and Approved Scanning Vendors as qualified and trained by PCI SSC, so ask the ones you are considering for quotes, and ask your acquirer which validation applies before you do.

Does Purplecop help with PCI DSS?

Yes. Purplecop Security's GRC & Compliance Advisory service lists PCI DSS in its framework adoption work, alongside ISO/IEC 27001, SOC 2, NIST CSF 2.0, HIPAA, DPDPA and GDPR. The service also includes a gap assessment against your target framework, with a prioritized remediation plan, and its page lists audit readiness and auditor liaison. The page does not say how those apply to PCI DSS validation.

This is advisory support. Your acquirer or payment brand decides how you validate. Where an assessment by a Qualified Security Assessor is part of that, it is performed by an organization the Council has qualified and trained, which Purplecop's advisory work does not replace.

What does PCI DSS stand for?

PCI DSS stands for Payment Card Industry Data Security Standard. The PCI Security Standards Council maintains it as a baseline of technical and operational requirements to protect payment account data.

Who requires PCI DSS compliance?

The PCI Security Standards Council maintains PCI DSS but says it does not enforce compliance. It says whether an entity is required to comply with or validate compliance "is at the discretion of organizations that manage compliance programs, such as a payment brand, acquirer, or other entity." Ask your acquirer or payment brand what applies to you.

What is the current version of PCI DSS?

PCI DSS v4.0.1, published June 11, 2024, was the version the PCI SSC Document Library listed as current on October 24, 2026.

Who validates PCI DSS compliance?

It depends on your acquirer or payment brand. Depending on their program, validation can be a Report on Compliance, with an assessor such as a Qualified Security Assessor testing the environment, or a Self-Assessment Questionnaire. Approved Scanning Vendors provide external vulnerability scanning services under the applicable requirement.

Can Purplecop make my business PCI DSS compliant?

Purplecop does not promise a PCI DSS outcome: validation follows the program your acquirer or payment brand sets, for example a ROC or SAQ. Purplecop Security's GRC & Compliance Advisory service lists PCI DSS in its framework adoption work and includes a gap assessment against your target framework, with a prioritized remediation plan. Its page does not say how that applies to PCI DSS validation.