Information security
PCI DSS
PCI DSS (Payment Card Industry Data Security Standard)
PCI DSS is the card industry's mandatory security standard for anyone handling payment card data. We help you scope it down, meet the requirements, and validate compliance.
What PCI DSS is
PCI DSS is a security standard maintained by the PCI Security Standards Council that applies to every organisation that stores, processes or transmits cardholder data. It sets out requirements across network security, protecting stored data, encryption, access control, monitoring and testing, and maintaining an information security policy.
How you validate depends on how you handle card data and your transaction volume. Many organisations complete a Self-Assessment Questionnaire (SAQ), while larger merchants and service providers are assessed on site by a Qualified Security Assessor (QSA) and produce a Report on Compliance. Reducing the scope of your cardholder data environment is usually the single biggest lever on cost and effort.
The structure of the standard
Goal 1 · Build and maintain a secure network and systems
Requirements 1 and 2 cover network security controls and the removal of insecure default configurations and passwords.
Goal 2 · Protect account data
Requirements 3 and 4 govern how stored cardholder data is protected and how data is encrypted when transmitted across open, public networks.
Goal 3 · Maintain a vulnerability management programme
Requirements 5 and 6 cover protection against malicious software and the development and maintenance of secure systems and applications.
Goal 4 · Implement strong access control measures
Requirements 7, 8 and 9 restrict access to cardholder data by business need to know, authenticate every user, and limit physical access.
Goal 5 · Regularly monitor and test networks
Requirements 10 and 11 cover logging and monitoring of access to data and the regular testing of security systems and processes.
Goal 6 · Maintain an information security policy
Requirement 12 covers the organisational policies and programmes that support information security for all personnel.
Who needs it
- Merchants that accept card payments, in person or online
- Service providers that store, process or transmit cardholder data on behalf of others
- Fintech and SaaS platforms that touch the payment flow in any way
What you get
- A documented cardholder data flow and scoped environment
- Controls and policies mapped to the PCI DSS requirements
- Penetration test evidence and coordinated vulnerability scanning
- Readiness and support for your SAQ or QSA assessment
Timelines depend on your scope, transaction profile and validation route. We scope it honestly up front rather than promise a fixed number of weeks.
Current version
The current edition is PCI DSS v4.0.1, a limited correction of v4.0 published by the PCI Security Standards Council. The transition from v3.2.1 is complete, and the future-dated v4 requirements that were best practice during the phase-in became mandatory on 31 March 2025. If your last assessment was against an earlier version, the practical work now is confirming that those newly required controls, such as expanded authentication and targeted risk analyses, are in place and evidenced rather than merely planned.
What it costs
Two costs usually sit side by side. tr3labs charges a scoped advisory and implementation fee, quoted up front once we understand your size, how you handle card data and your starting point. Where validation runs through a Qualified Security Assessor, an Approved Scanning Vendor or an acquiring bank, that party charges separately on its own schedule, and tr3labs is never the assessor, scanning vendor or card brand. We scope the engagement with you rather than quote blind.
How tr3labs gets you there
Scope and gap assessment
We map how card data flows through your systems, work to minimise your cardholder data environment, confirm the right SAQ or assessment route, and measure you against the applicable requirements.
Build the controls
We help you implement segmentation, encryption, access control, logging and the policies PCI DSS requires, and assemble the evidence to support them.
Test and prove
We carry out the penetration testing and internal reviews the standard expects and coordinate the required vulnerability scanning so the control environment is proven.
Validation support
We prepare you to complete your SAQ or to be assessed by a QSA, and support you through validation to a documented compliance outcome.
PCI DSS and SOC 2 compared
Both are security assurance regimes often requested of the same technology business, which is why they get confused.
| PCI DSS | SOC 2 | |
|---|---|---|
| Covers | Payment card data specifically | Controls relevant to a service you operate |
| Who asks for it | Card brands and acquiring banks | Enterprise customers and their procurement teams |
| Core idea | A fixed set of prescriptive requirements | Criteria you meet through controls of your own design |
| Audit model | SAQ, or QSA assessment and Report on Compliance | Independent CPA audit and attestation report |
| Outcome | A validated compliance status | A Type I or Type II report, not a certificate |
| Often held with | ISO 27001 and SOC 2 | ISO 27001 and PCI DSS |
PCI DSS FAQ
- How much does PCI DSS compliance cost?
- Our scoped advisory and implementation fee is quoted up front once we understand how you handle card data. Where validation runs through a QSA, an ASV or your acquiring bank, that party charges separately on its own schedule; tr3labs is never the assessor or scanning vendor.
- How long does PCI DSS take?
- It depends on your scope, transaction profile and validation route. We scope the timeline honestly up front rather than promise a fixed number of weeks.
- Do we need a QSA or can we self-assess?
- It depends on how you handle card data and your transaction volume. Many organisations validate with a Self-Assessment Questionnaire, while larger merchants and service providers are assessed by a Qualified Security Assessor. We confirm the right route for you during scoping.
- How can we reduce the cost of PCI DSS?
- The most effective lever is reducing scope: limiting where card data is stored, processed or transmitted, using segmentation, and offloading the payment flow to compliant providers where sensible. We focus on scope reduction early because it lowers both effort and risk.
- Does PCI DSS require penetration testing?
- Yes. PCI DSS requires regular penetration testing and vulnerability scanning of the cardholder data environment. Our manual testing meets that requirement and feeds directly into your validation.
The services that get you there
Related standards
Related reading
The OWASP LLM Top 10, Explained: A Plain-English Guide for Teams Shipping AI Features
A clear, practical walkthrough of the OWASP Top 10 risks for large language model applications, with a plain-English description and a concrete mitigation for each, aimed at teams adding AI features for the first time.
9 min read
How to Read a Penetration Test (VAPT) Report: A Plain-English Guide for Teams
A practical walkthrough of what goes into a penetration test report, section by section, so founders and engineering teams can read one with confidence and act on what it says.
8 min read
SOC 2 vs ISO 27001: an honest comparison to help you choose
A plain-English guide to the real differences between SOC 2 and ISO 27001: what each one is, who asks for which, how the audits work, what you end up holding, and whether you should do both.
8 min read