PCI DSS control objectives and compliance requirements are legally enforceable. While they are not required by law, the PC Security Standards Council can require businesses to follow PCI standards if they want to handle credit card transactions and revoke that access when a business fails to meet the standard’s requirements.

So as a practical matter, any business that handles payment processing, storage, or transmission of credit card data electronically, regardless of its size or the volume of its transactions, is subject to PCI DSS compliance.

PCI DSS is a security standard created to address and curb the prevalence of data breaches that involve payment credit or debit cards.

PCI is a data security standard created by the credit card industry. Any company that processes, stores, or transmits credit card data is obligated to comply with this standard. Alternatively, ISO 27001 is an international standard that provides the framework for an information security management program for any type of organization. More to the point, ISO 27001 certification is optional.

PCI data includes cardholder data such as:

• Name
• Account number
• Card expiration date
• CVV or security code

It also includes authentication data, such as the magnetic-stripe, chip, and pin data.

• STEP 1: Determine your PCI level (1-4).
• STEP 2: Complete a self-assessment questionnaire or evaluation by a Qualified Security Assessor (QSA).
• STEP 3: Build and maintain an IT security program that protects cardholder data and meets the guidelines specified in the PCI control objectives.
• STEP 4: Apply for formal attestation of compliance with the PCI Security Standards Council, as applicable for service providers such as scanning vendors and point-to-point encryption assessors.

Cybersecurity risk analysis allows your organization to identify your sensitive data, understand your risks and devise a strategy to protect that data and mitigate those risks. This type of analysis is also a great opportunity for an organization to take an inventory of systems and resources and ensure that each is safeguarded by the proper security controls.

For smaller organizations at levels 2 through 4, with a self-assessment questionnaire, vulnerability scanning, IT security development, and remediation of risk, you could be looking at costs of $10,000 to $20,000.

A large enterprise, on the other hand, typically needs on-premise auditing, vulnerability scanning, penetration testing, training, IT security development, and risk remediation. That organization might incur costs of $70,000 to $100,000 for PCI compliance.