What is PCI DSS and why it applies to your institution
Payment Card Industry Data Security Standard (PCI DSS) is a global card data security standard created by Visa, Mastercard, American Express, Discover, and JCB. Version 4.0, fully effective since March 2025, introduces significant changes.
For banks and fintechs, PCI DSS isn’t optional — it’s a business requirement. Non-compliance means financial penalties ($5,000-$100,000/month), loss of card processing ability, and fraud loss liability. Combined with DORA, financial institutions must meet both sets of requirements simultaneously.
The 12 PCI DSS v4.0 requirements
Build and maintain a secure network
- Install and maintain network security controls — firewalls, segmentation, traffic control between trust zones
- Secure system configuration — remove defaults, hardening, service minimization
Protect cardholder data
- Protect stored cardholder data — encryption, tokenization, PAN masking, data retention
- Encrypt transmission — TLS 1.2+, certificates, data-in-transit protection
Vulnerability management
- Malware protection — antivirus, EDR, regular signature updates
- Secure software development — secure SDLC, code review, application security testing
Access control
- Restrict access to cardholder data — least privilege, need-to-know basis
- Identification and authentication — unique IDs, MFA mandatory for all, password policy
- Physical security — access control to card system rooms, monitoring
Monitoring and testing
- Logging and monitoring — centralized logging, SIEM, security alerts, 12-month log retention
- Regular testing — vulnerability scanning (ASV), penetration testing, segmentation tests
- Security policy — documentation, roles, training, risk management
What’s new in PCI DSS v4.0
Customized Approach
PCI DSS v4.0 introduces an alternative validation method — Customized Approach. Instead of meeting exact technical requirements (Defined Approach), an institution can propose custom controls meeting the requirement’s objective. Requires documented risk analysis and QSA evaluation.
MFA mandatory everywhere
New requirement: multi-factor authentication for all access to the CDE (Cardholder Data Environment), not just remote access. Applies to internal network access as well.
Continuous monitoring
Shift from periodic scans to continuous security monitoring. Automatic detection of configuration changes, new vulnerabilities, and log anomalies.
PCI DSS implementation step by step
Step 1: Scoping
Identify all systems, processes, and people in contact with payment card data. Map cardholder data flow across the organization. Minimize scope through network segmentation and tokenization.
Step 2: Gap analysis
A security audit assessing current state against all 12 PCI DSS v4.0 requirements. Prioritize gaps by risk and effort level.
Step 3: Remediation
Implement missing controls: network segmentation, encryption, MFA, monitoring, policies. Configure SOC with correlation rules for the card payment environment.
Step 4: Testing
Penetration testing of CDE, vulnerability scanning (ASV), network segmentation tests, system configuration verification.
Step 5: Validation and certification
Depending on level: Self-Assessment Questionnaire (SAQ) for smaller entities or full audit by Qualified Security Assessor (QSA) for Level 1.
Step 6: Maintaining compliance
PCI DSS is a continuous process: quarterly ASV scans, annual penetration tests, continuous monitoring, policy reviews, staff training.
PCI DSS and DORA
Financial institutions processing card data must comply with both standards. DORA focuses on general operational resilience, PCI DSS on card data security. Many controls overlap (risk management, testing, monitoring), enabling efficient compliance management.
Recommendation: an integrated compliance framework covering DORA, PCI DSS, NIS2, and GDPR — instead of a siloed approach to each regulation separately.
How nFlo supports PCI DSS compliance
- Security audits — PCI DSS v4.0 gap analysis, scope assessment, gap prioritization
- Penetration testing — CDE tests, segmentation tests, payment application tests
- SOC as a Service — 24/7 CDE monitoring, security alerts, PCI DSS-compliant log retention
- Compliance support — integrated PCI DSS + DORA + NIS2 framework implementation
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
