What Is PCI DSS and Why It Applies to Online Stores
PCI DSS (Payment Card Industry Data Security Standard) is a security standard developed by the PCI SSC (Payment Card Industry Security Standards Council), formed by Visa, Mastercard, American Express, Discover, and JCB.
The standard applies to every entity that stores, processes, or transmits payment card data — regardless of company size or transaction volume. This includes:
- Online stores with their own payment forms
- Stores using payment gateways (to a limited extent)
- Marketplace platforms
- Subscription services
Since March 31, 2025, PCI DSS v4.0 is in effect, introducing significant changes regarding payment page security in e-commerce, including new requirements for JavaScript script monitoring.
12 PCI DSS Requirements — Overview for E-commerce
PCI DSS v4.0 includes 12 requirement groups across 6 categories:
Build and maintain a secure network:
- Install and maintain network firewalls
- Apply secure system configurations (no default passwords)
Protect cardholder data: 3. Protect stored card data (encryption) 4. Encrypt card data transmission across public networks (TLS 1.2+)
Vulnerability management: 5. Protect against malware and regularly update antivirus 6. Develop and maintain secure systems and applications
Access control: 7. Restrict access to card data on a need-to-know basis 8. Identify and authenticate access to systems 9. Restrict physical access to card data
Monitoring and testing: 10. Log and monitor access to network resources and card data 11. Regularly test security systems and processes 12. Maintain an information security policy
PCI DSS Compliance Levels for E-commerce
PCI DSS defines 4 compliance levels based on annual transaction volume:
Level 1 — over 6 million transactions/year
- Annual audit by a Qualified Security Assessor (QSA)
- Quarterly network scans by ASV
- ROC (Report on Compliance)
Level 2 — 1-6 million transactions/year
- Annual Self-Assessment Questionnaire (SAQ)
- Quarterly ASV scans
Level 3 — 20,000 - 1 million e-commerce transactions/year
- Annual SAQ
- Quarterly ASV scans
Level 4 — under 20,000 e-commerce transactions/year
- Annual SAQ (recommended)
- Quarterly ASV scans (recommended)
Important: Even a Level 4 store is required to meet PCI DSS requirements. The difference lies in validation method — SAQ vs. formal audit.
New PCI DSS v4.0 Requirements for E-commerce
PCI DSS v4.0 introduced key changes directly affecting online stores:
Requirement 6.4.3 — Script management on payment pages Every JavaScript script loaded on the payment page must be:
- Authorized and documented
- Monitored for integrity
- Business justified
This requirement is a direct response to Magecart attacks and web skimming.
Requirement 11.6.1 — Payment page change detection The store must implement a mechanism to detect unauthorized modifications to HTTP headers and payment page content.
Requirement 8.3.6 — Password complexity Minimum password length increased to 12 characters (from previous 7). Applies to all accounts with access to card data.
Customized approach PCI DSS v4.0 allows a “customized approach” — instead of implementing a specific technical control, a company can demonstrate that it achieves the same security objective through alternative means.
PCI DSS Implementation Plan for an Online Store
Implementing PCI DSS in e-commerce requires a systematic approach:
Phase 1: Scope assessment (1-2 weeks)
- Mapping card data flow across infrastructure
- Identifying all systems that process, store, or transmit card data
- Determining compliance level
Phase 2: Gap analysis (2-4 weeks)
- Security audit of current state
- Identifying gaps against PCI DSS requirements
- Prioritizing remediation activities
Phase 3: Remediation (1-6 months)
- Implementing missing technical controls
- Developing required policies and procedures
- Staff training
Phase 4: Validation (2-4 weeks)
- ASV (Approved Scanning Vendor) scan
- Completing SAQ or conducting QSA audit
- Compliance documentation
Pro tip: The simplest way to reduce PCI DSS scope is tokenization — moving card data processing to a certified provider (Stripe, Adyen). This ensures card data never passes through your servers.
Consequences of PCI DSS Non-Compliance
Non-compliance with PCI DSS carries serious consequences:
Financial penalties:
- $5,000 - $100,000 per month for non-compliance (imposed by card brands)
- Up to $500,000 fines for card data breaches
- Forensic investigation costs after an incident
Operational consequences:
- Loss of ability to accept card payments
- Elevation to a higher (more expensive) validation level
- Higher interchange fees
Legal liability:
- Liability for customer losses resulting from data breaches
- GDPR violations (card data is personal data) — fines up to 4% of turnover
- Class action lawsuits from affected customers
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Related services and products
Frequently asked questions
Does a store using Stripe/PayU still need PCI DSS compliance?
Yes, but to a limited extent. Using a hosted payment form (iframe) significantly reduces the number of requirements to fulfill. You complete SAQ A (the shortest questionnaire) instead of SAQ D. However, you must still meet basic website security requirements.
How much does PCI DSS implementation cost for an online store?
Cost depends on the level. For small stores (SAQ A with tokenization), it is mainly configuration and annual ASV scan costs. For large platforms (Level 1), QSA audit costs range from $25,000-$125,000, plus security implementation costs.
How often must PCI DSS compliance be renewed?
Compliance validation (SAQ or QSA audit) is annual. ASV scans are quarterly. Monitoring and many technical controls must operate continuously. PCI DSS is an ongoing process, not a one-time project.
