The Payment Card Industry Data Security Standard (PCI DSS) was founded in 2006 as a joint venture by several of the leading credit card companies, including MasterCard, Discovery, Visa, American Express, and JCB International. The PCI DSS (currently at version 3.2.1) applies to all institutions, merchants, and businesses that accept, process, transmit, and store credit card information and associated details. The purpose of this standard remains solely to protect merchants, service providers, and consumers alike from financial and goodwill losses that may be sustained due to breaches of data security as it relates to credit cards and associated Personally Identifiable Information (PII).

According to the PCI DSS, cardholder data includes:

• The name of the cardholder
• The cardholder's account number
• The cardholder's service code
• The card's expiration date

The PCI DSS comprises 6 goals and 12 requirements. All 6 goals and 12 requirements can be achieved via an in-depth assessment, which verifies that measures have been taken to actively ensure the protection of cardholder information. Although satisfying 6 goals and 12 achievements may sound simple enough, there are actually 250 PCI sub-requirements.

According to MasterCard, the six goals of the PCI DSS are as follows:

• Building and maintaining a secure network and systems
• Protection of cardholder data
• Maintaining a vulnerability management program
• Implementing strong access control measures
• Regularly monitoring and testing networks
• Maintaining an information security policy

The volume of cardholder transactions processed determines the types of assessments required to be completed by companies. Some companies, such as Discover Global Network (of the Discover card), require that all merchants that process, transmit, or store cardholder data using the Discover network are PCI-compliant.

Credit card institutions have various levels and categories with which they identify compliance requirements, as listed in the following section. The criteria vary between institutions, although, the requirements are the same for all:

• Level 1: An annual on-site security assessment report detailing assessed systems that process, store, or transmit credit card information must be submitted. A quarterly network scan is also required, which must be conducted by an Approved Scanning Vendor (ASV), to remotely scan for vulnerabilities and potential threats.
  • American Express yearly volume transaction: 2.5 million (or more)
  • MasterCard yearly volume transaction: 6 million or more
• Level 2: 50,000-2.5 million. An annual self-assessment is required, along with the quarterly network scan. An on-site assessment can also be provided at the merchant's discretion.
  • American Express yearly volume transaction: less than 50,000
  • MasterCard yearly volume transaction: between 1 and 6 million
• Level 3: An annual self-assessment is required, along with the quarterly network scan. An on-site assessment can also be provided at the merchant's discretion.
  • American Express yearly volume transaction: less than 50,000
  • MasterCard yearly volume transaction: more than 20,000, but less than 1 million

Additional levels:

• Level EMV (American Express): The processing of more than 50,000 chip-enabled card transactions requires an annual EMV Attestation (AEA) self-examination.
• Level 4 (MasterCard): An annual self-assessment is required, along with the quarterly network scan. An on-site assessment can also be provided at the merchant's discretion.