PCI Security Standards: The PCI Security Standards Council and Every PCI Standard

PCI security standards are the security requirements for payment card data, devices and processes published by the PCI Security Standards Council (PCI SSC, sometimes called the PCI DSS council). The Council was founded in 2006 by American Express, Discover, JCB International, Mastercard and Visa. It maintains the PCI Data Security Standard (PCI DSS) that most businesses meet, plus specialist standards for PIN processing, card manufacturing, payment terminals, encryption and software. It writes the standards and qualifies the assessors who check them. It does not enforce them: the card brands and acquirers decide who must comply and what happens if they do not.

This page maps the whole family. If you only need to know what PCI DSS asks of your business, start with our guide to what is PCI DSS.

What is the PCI SSC?

The PCI SSC is a global standards body set up by the payment card brands to manage one set of security requirements instead of a separate programme for each brand. The Council says plainly that it does not monitor how its standards are implemented; whether an organisation must comply, and how it proves it, is decided by the brands and acquirers that run compliance programmes.

The Council’s work falls into four areas: publishing and updating the standards, training and qualifying assessors, keeping public listings of approved assessors, devices, solutions and software, and publishing guidance such as FAQs and information supplements.

Who created PCI DSS?

The card brands did. Before PCI DSS, each brand ran its own security programme, so a merchant could face several overlapping sets of rules. The brands aligned them into PCI DSS version 1.0, published in December 2004, and created the PCI SSC in 2006 to own and develop the standard.

The current version is PCI DSS v4.0.1, published in June 2024 and the only active version. The future-dated requirements first introduced in v4.0 became mandatory on 31 March 2025, so every assessment now covers them.

The brands still set the rules around the standard: which merchants and service providers must validate, the levels that decide between a Report on Compliance (ROC) from a Qualified Security Assessor and a Self-Assessment Questionnaire (SAQ), and any penalties. Your acquirer passes those rules on through your merchant agreement. To see which SAQ your own set-up points to, try our free PCI compliance check.

How many PCI security standards are there?

When we checked in October 2026, the PCI SSC standards page listed 17 standards. That count includes the retired Payment Application Data Security Standard (PA-DSS) and three standards in a formal sunset period from 1 May to 31 October 2026, after which PCI SSC accepts no new submissions for them, although existing listings stay valid until their expiry dates: Software-based PIN Entry on COTS (SPoC), Contactless Payments on COTS (CPoC) and the 3DS SDK standard. The table covers the standards in active use.

Most businesses only ever deal with PCI DSS; the others reach them mainly when they choose a listed terminal, solution or software product.

Which PCI assessor programmes exist, and what does each sign?

Each standard has its own assessor programme. PCI SSC trains and qualifies the assessor companies and their staff and lists them publicly, so you can check any firm’s approval on the PCI SSC assessor listings before you hire it.

Sovereign Secure holds five of these approvals: QSA company, Qualified PIN Assessor, Card Production Security Assessor, P2PE Assessor (Europe and USA) and 3DS Assessor, covering PCI DSS, PCI PIN, card production, P2PE solutions and components, and PCI 3DS. The other programmes are described here for information only.

What is the PCI SSC Global Executive Assessor Roundtable (GEAR)?

GEAR is an advisory group of senior executives from PCI assessor companies. PCI SSC created it in 2018 as a direct line between the leadership of assessor companies and the Council’s own leadership. Members advise on the assessor programmes, including training content and qualification requirements, meet quarterly and take part in Council projects when asked.

Membership is capped at 35 companies. The Executive Committee chooses members from eligible nominees for two-year terms, using criteria the Council publishes, including how long a company has been an active assessor and how many assessor programmes it takes part in. Sovereign Secure is a GEAR member for 2026 to 2028. GEAR advises the Council on how its programmes run; it does not change how any individual assessment is carried out or judged.

Are PCI standards regulations or law?

No. PCI standards are industry standards, enforced by contract through card brand rules and your merchant agreement, not by law. “PCI regulations” or “PCI rules and regulations” usually means those brand rules: merchant levels, validation deadlines and the fees acquirers charge when validation is missing or late.

No UK statute requires PCI DSS. Data protection law still applies, though: card data linked to an individual is personal data, and UK GDPR requires appropriate security for it. A card data breach can therefore raise regulatory questions as well as contractual ones, as our guide to GDPR and PCI compliance explains.

What do people mean by “PCI data”?

“PCI data” is shorthand for the data PCI DSS protects, which the standard calls account data: cardholder data, led by the primary account number (PAN), and sensitive authentication data such as full track data, card verification codes and PINs. “PCI data compliance” means meeting PCI DSS wherever that data is stored, processed or transmitted, and for any system that could affect its security.

Across the wider family, other standards protect the same data at different stages. PIN Security covers PINs and the keys that encrypt them, Card Production covers card data and keys while cards are made and personalised, and P2PE covers card data from the terminal to the point of decryption. Our guide to what counts as PCI data lists each data element and whether you may store it.

Why use Sovereign Secure?

• Five PCI SSC approvals in one team: Sovereign Secure Ltd is a PCI SSC-approved QSA company, Qualified PIN Assessor, Card Production Security Assessor, P2PE Assessor (Europe and USA) and 3DS Assessor, so PCI DSS, PIN, card production, P2PE and 3DS assessments can be planned together.
• GEAR member for 2026 to 2028, verifiable on the PCI SSC website.
• Scanning through an approved partner: quarterly external ASV scans are delivered through our PCI SSC Approved Scanning Vendor partner.
• Wider assurance: ISO 27001 certified and an IASME-licensed Cyber Essentials certification body.
• Established: incorporated in 2012, headquartered at 16 Whalley Road, Accrington, with offices in Los Angeles, Singapore, Dubai and Dhaka.

What should you do next?

If you know which standard applies to you, tell us through the enquiry form and we will scope the assessment and send a fixed quote. If you are not sure whether you need PCI DSS, PIN or card production validation, call +44 161 523 5276 and we will help you work out which route your acquirer or the payment brands expect.