Let's take a look at what PCI DSS compliance is, and how your business can get compliant
The PCI Security Standards Council was created with a simple goal: to protect payment systems from breaches and theft of cardholder data.
The Council was founded in 2006 by American Express, Discover, JCB International, Mastercard and Visa. The Council’s stated goal was about improving security safeguards at every step of card transaction processing. The business driver was a commercial imperative – to protect cardholder data. To enable this outcome a security standard was created that mandated safeguards and defined processes that met the agreed objectives – Payment Card Industry Data Security Standard (PCI DSS or just PCI). The standard has been revised several times to meet emerging challenges as the security landscape has evolved, and the current version is PCI DSS v4.0.1.
The standard is very clear on merchant obligations required to handle cardholder data.
Any entity that;
The caveat in the standard is that many smaller organisations now have the means to accept credit cards and transact business with portable point-of-sale (POS) terminals like Square or with commercial providers like PayPal.
In this scenario, the merchant’s PCI DSS obligations are smaller but don’t disappear. Small businesses may accept cards and process the transaction but cardholder data is not stored, and they usually validate with a shorter Self-Assessment Questionnaire. The counterpoint is that cybersecurity is so critical to delivering commerce that it borders on corporate negligence not to have the basic PCI safeguards in place.
The Office of the Australian Information Commissioner (OAIC) received 1,205 data breach notifications in 2025, the highest number on record, and the majority were attributable to malicious or criminal activity. Cardholder data has a ready resale market on the dark web, which makes any business that handles it an attractive target for criminals.
The goal of implementing PCI is to define a series of baseline security safeguards that will better protect cardholder’s data and reduce the risk and incidence of credit card fraud. The PCI standard mandates a series of security controls and requires that merchants implement a sequence of predetermined audits to validate compliance. The standard has a sting in the tail. The PCI Security Standards Council does not impose penalties itself, but the payment card brands and acquiring banks may impose fines or restrict transactions if compliance is not maintained, particularly after a data breach. Ultimately, the PCI standard enforces greater business discipline and encourages a culture of best practice across the organisation when combined with rigorous training and ongoing refresher courses.
PCI compliance standards are overseen by the PCI Security Standards Council who define a minimal standard for controls required to protect cardholder data. Merchant levels are set by the payment card brands and determine how a merchant must validate compliance, based on its number of annual transactions. As a guide, the lower merchant level for PCI compliance is 20,000 annual transactions while the upper threshold is 6 million.
| PCI Merchant Level | Annual Visa or Mastercard transactions |
| Level 1 | More than 6 million |
| Level 2 | 1 to 6 million |
| Level 3 | eCommerce merchants processing more than 20,000 and up to 1 million |
| Level 4 | All other merchants |
To complicate things further, the merchant’s bank (“acquirer” is the technical term) contractually enforces validation with its merchant partners. Agreements differ depending upon the acquirer but typically address three prerequisites;
This is a mandatory requirement for merchants, at least once every three months, and a task that’s regularly scheduled for organisations who take cybersecurity seriously. The scans must be performed by a PCI SSC Approved Scanning Vendor (ASV) and can help identify where the special focus should be applied to safeguard cardholder data.
Acquirers require Level 1 merchants to have an annual Report on Compliance completed by a Qualified Security Assessor (QSA), and some Level 2 merchants may also need one, depending on how they handle card data. The QSA undertakes the review to ensure compliance with PCI standards.
The SAQ is a validation tool used by merchants and service providers who are not required to undergo the scrutiny of an onsite assessment.
These examples are taken from Westpac’s PCI DSS guidance for merchants, but all of the major Australian acquirers have similar levels of oversight that complement PCI’s rigorous guidelines and policies.
The PCI DSS standard is made up of 12 principal requirements that are broken down into detailed sub-requirements. These controls must meet PCI standards with their configuration and dependencies fully documented. As the technology has advanced, so too has the choices available to meet the stated prerequisites. Achieving a tick in the box may not deliver the best ROI on an organisation’s spend, but convincing management of this can occasionally be easier said than done.
Owning and maintaining a firewall is a standard part of every foundation security framework. PCI DSS v4.0.1 now refers to network security controls (NSCs), such as firewalls and other network security technologies. The role of the firewall has morphed over time with the typical office system often serving many more roles than just stopping bad folks gaining access to corporate assets. This has added greater complexity to administering filtering devices and securing internet-facing access. In most organisations, it falls to the “generalist” IT team to configure and maintain firewalls and security controls but this approach poses many risks. Having a misconfigured firewall may provide a false sense of security and presents a grave danger to overall security. The skill level needed to maximise the firewall ROI is analogous to a surgeon. Likewise, typical IT professionals are GPs who must be able to solve a multitude of daily challenges that cross technical boundaries. The configuration is one thing, but firewall optimisation is also vital to ensure fast network performance and maximise staff productivity. Cloud computing solves many business computing requirements but securely integrating cloud into legacy DMZ environments is fraught with risk. Microsoft Azure and Amazon Web Services (AWS) are ecosystems that are in constant flux as new features are added, updated or reach their end of life (EOL). Cloud specialists have difficulties keeping abreast of this change and it may be unfair to place the responsibility on generalist IT staff.
One solution worth considering is a managed firewall service where you have access to security focussed engineers with the requisite skills and business acumen needed to align security with business processes. This approach helps cash-flow and maximises ROI.
It’s still amazing that security technology ships with default login credentials like “admin + admin”. Dedicated websites exist that list default passwords, with “cirt.net” offering more than 2,100 passwords from over 530 IT vendors. Fortunately, hardware vendors are finally adding forced reset to their equipment to change passwords at initial power-up. Sadly, this only solves one password challenge that administrators must contend with. Login credentials, passwords and other security settings are created to protect and harden your PCI compliant environment. Passwords, password policy and resets can demand swathes of IT support time at enormous financial and opportunity cost. Added safeguards like multi-factor authentication should be deployed and those annoying monthly password refreshes dispensed with; PCI DSS v4.0.1 only requires passwords to be changed at least every 90 days where a password is the only authentication factor. Legacy password policies are circumvented and lead to weaker security and higher operating costs. Password sharing should be made a sackable offence: this will focus employees’ minds on better security.
There’s a simple rule of thumb in the security industry: try to avoid storing cardholder data. It’s attractive loot with a ready resale market. This is one area where protecting data has improved at a much lower cost.
When the PCI standard was created, encrypting data was expensive and complex but as technology has evolved and the cost of hardware security modules (HSM) has fallen, in-house encryption delivers a rapid ROI and peace of mind. Alternatively, cloud HSM services such as AWS CloudHSM and Azure Managed HSM are validated to FIPS 140-3 Level 3, which can support many cryptographic key management requirements.
Using older protocols for encrypted transmission poses a grave risk to securing cardholder data. The Internet Engineering Task Force (IETF) has ratified TLS 1.3, and the PCI DSS deadline for disabling SSL and early TLS passed on 30 June 2018, but older versions of TLS and SSL are still found in production environments today. Get rid of them and update to the latest supported version that integrates with your PCI safeguards.
Security safeguards that mitigate virus and malware threats are now typically part of a suite of features that protect against data exfiltration, offer real-time threat analysis and most importantly can be centrally managed. Firewalls offer ingress protection against threats based on the feature set, vendor partnerships and allegiances. Delivering the best ROI requires the dispassionate review of how internal systems and processes can be supported. The term now used is “endpoint” protection that encompasses mobile devices too. Careful research and close collaboration with a security partner (like StickmanCyber) is vital to ensure that this safeguard doesn’t become a vulnerability.
Software patching failures have topped the list of security blunders since the widespread deployment of IT systems. If organisations took a more diligent and disciplined approach to patching, global cybersecurity would be greatly enhanced. Solving this limitation is best achieved by automating patching across operating systems and applications. Don’t forget firmware either. Almost anything that is internet facing poses grave risks to business: access-points, printers, routers and firewalls are typical examples of devices that have been compromised because of patching failures.
In the realm of military defence, the concept of security clearance is implemented across servicepeople.
In a commercial context the expression “need to know” sums up the best practice approach to handling sensitive cardholder data. Access should be limited based on roles, responsibilities and underpinned with a security policy that applies the need-to-know concept across all corporate data.
For most organisations, the unique identifier is an employee’s email address. To compound the issue, email addresses tend to follow a corporate protocol for efficiency – first name dot last name @ the organisation. That’s logical and productive but reduces PCI security particularly against brute-force attacks. For better security consider implementing multi-factor authentication across the board but singularly focus on protecting those stakeholders with elevated security access. PCI DSS v4.0.1 now requires MFA for all non-console access into the cardholder data environment (Requirement 8.4.2). Administrators and senior management are good candidates for this upgrade. Specific groups like HR or Finance who handle sensitive data should also be prioritised for MFA deployment.
Don’t forget to lock the doors and windows.
Proactive security management can be automated with a Security Information and Event Management (SIEM) that provides real-time analysis of information systems. The SIEM logs activity from across the enterprise and identifies “anomalous” behaviour that could indicate a security incident. What vendors don’t tell you before they sell you these systems is that it’s vital to have the resources available to configure, manage and monitor the system or the purchase is almost pointless. To deliver the best ROI, work with a security partner who has made the investment in a Security Operations Centre that operates 24/7 and has dedicated security engineers able to review network activities on your behalf.
The security of your organisation is built upon three key deliverables;
It’s incumbent on management that they understand their legal obligations as well as their responsibility to stakeholders and do their utmost to protect digital assets and privacy. Penetration testing and vulnerability assessments are a mandatory requirement for meeting PCI compliance: external vulnerability scans by an ASV at least once every three months, and external penetration testing at least once every 12 months and after any significant change. Please refer to our blog post that details the minutiae of pen testing for a more granular overview.
The job isn’t done until the paperwork is finished!
Ensure security policies are kept current and the documentation meets PCI standards. Good documentation can help new hires quickly learn and implement policy and maintain your organisation’s security posture too. Given the enormous cost and time required to meet PCI documentation standards, it’s important that the effort expended helps produce better security outcomes.
Meeting and maintaining PCI compliance shouldn’t be viewed in isolation from other security initiatives. Where possible, combine PCI projects and upgrades with other initiatives to drive change that delivers better security across the organisation. This will improve the ROI of your PCI budget too.
Finally, don’t forget the unwritten 13th PCI compliance rule. Every dollar invested in security and awareness training is a dollar well spent. Under Australia’s Notifiable Data Breaches scheme, human error caused 37% of the data breaches reported to the OAIC from January to June 2025. More than one in three!
Want more value from your PCI DSS spend? StickmanCyber’s PCI DSS compliance service takes you from scope to attestation in 5 steps. Book a free consultation today.
Keep fewer systems in contact with card data. PCI DSS v4.0.1 says segmenting the cardholder data environment from the rest of your network is not required, but it can reduce the scope and cost of an assessment. A PCI-listed point-to-point encryption (P2PE) solution can significantly reduce the number of requirements that apply, although it doesn’t remove PCI DSS altogether.
It is a PCI Security Standards Council tool that groups the requirements into six milestones, so a non-compliant business can tackle its highest risks first, starting with removing sensitive authentication data and limiting data retention. It doesn’t replace PCI DSS, and Australian acquirers such as Westpac ask non-compliant Level 1 to 3 merchants to report progress with it each quarter.
Not automatically. The OAIC says that complying with a standard does not of itself mean you have taken reasonable steps to protect personal information under the Privacy Act. PCI DSS covers payment card data, while the Australian Privacy Principles cover all the personal information you hold, so treat PCI DSS as one part of your privacy and security program.
Every year, plus quarterly external vulnerability scans by an Approved Scanning Vendor. Level 1 merchants submit an annual Report on Compliance completed by a QSA company, while other merchants usually complete an annual Self-Assessment Questionnaire. Your acquirer confirms which validation documents you must provide.
You may be able to use a compensating control. PCI DSS v4.0.1 allows one only where a legitimate and documented technical or business constraint stops you meeting the requirement as stated. The control must meet the intent and rigour of the original requirement, go above and beyond other PCI DSS requirements, and be validated by your assessor.