What is PCI DSS?
Also known as: Payment Card Industry Data Security Standard
PCI DSS (Payment Card Industry Data Security Standard) is the international data security standard that every organisation processing, transmitting or storing card data must follow. It is published by the PCI Security Standards Council (PCI SSC), founded by Visa, Mastercard, American Express, Discover and JCB.
How does PCI DSS work?
- The standard consists of 12 core requirements covering network security, protection of cardholder data, access control, monitoring and testing, and security policies.
- Organisations are assigned levels based on annual transaction volume. Level 1 is the highest and requires an on-site assessment by an independent Qualified Security Assessor (QSA).
- Compliance is not a one-off: it is maintained through annual assessments, regular vulnerability scans and penetration tests.
Key points
- Mandatory for every gateway and service provider that touches card data
- Level 1 is the most comprehensive and most strictly audited level
- Tokenization and hosted payment pages shrink the merchant's own PCI DSS scope
PCI DSS with Treps
Treps is PCI DSS Level 1 certified. When businesses use Treps's payment page and tokenization, card data never enters their own systems, which significantly reduces their PCI DSS compliance burden.
Frequently asked questions
What does PCI DSS Level 1 mean?
Level 1 is the highest PCI DSS compliance level. Organisations at this level are assessed on-site every year by a Qualified Security Assessor (QSA), who produces a Report on Compliance (ROC). It is mandatory for high-volume service providers.
Does my e-commerce site need to be PCI DSS compliant?
Every business that accepts cards is within PCI DSS scope, but the size of that scope depends on how much you touch card data. Businesses that capture card details on a PCI DSS Level 1 provider's payment page and work with tokens have a much lighter compliance burden.