What is PCI DSS?
PCI DSS sets security requirements for organizations that store, process or transmit payment card data. What you need to do depends on your role (merchant or service provider) and your transaction volume: smaller organizations often complete a Self-Assessment Questionnaire, larger ones are assessed by a Qualified Security Assessor. Version 4.0.1 is the current version.
Who needs it
- Fintech and payments startups
- E-commerce and marketplaces that handle card data directly
- Service providers whose systems affect card data security
What usually triggers it
- You start accepting or processing card payments
- A bank or payment partner asks for your PCI status
- You move from a hosted checkout to handling card data yourself
How the process works
- Determine your merchant or service provider level
- Reduce scope where possible, for example with tokenization
- Implement the required controls
- Complete a Self-Assessment Questionnaire or a QSA assessment
- Maintain quarterly scans and annual validation
How Holam helps
We work out whether PCI DSS is what your customers actually need, and in what order alongside other frameworks. We then introduce you to a compliance platform and specialists that fit your stage, and stay involved until the result is in your hands. Holam receives a referral fee from providers we introduce when you engage them. You pay the provider directly, we add nothing to their price, and you remain free to choose another provider.
Frequently asked questions
If we use Stripe, do we still need PCI DSS?
You still have obligations, but a hosted payment provider can reduce your scope to a much simpler questionnaire.