PCI DSS anchors

Stefan Coetzeecreated 2026-05-12updated 2026-05-121 min readanchors
Vault note, not reviewed against the source. Written in the knowledge vault on 2026-05-12 by models working with Stefan Coetzee and published as it stands, with private addresses, e-mail addresses and an employer name redacted. Check claims against the primary source before relying on them.

Primary documents

  • PCI DSS v4.0 (March 2022) + v4.0.1 (June 2024).
  • PCI DSS Self-Assessment Questionnaires (multiple SAQ types).
  • PCI DSS Glossary.
  • Reporting Templates (Report on Compliance, Attestation of Compliance).

All free from PCI SSC.

Operating body

  • PCI Security Standards Council (PCI SSC) — founded 2006 by Visa, Mastercard, Amex, Discover, JCB.
  • Maintains PCI DSS plus PCI PIN Transaction Security, PCI P2PE, PCI 3DS, PCI Card Production, PCI Software Security Framework.

Validation roles

  • QSA (Qualified Security Assessor) — council-approved firms for Level 1 assessments.
  • ASV (Approved Scanning Vendor) — quarterly external scan providers.
  • PCIP (PCI Professional) — individual credential.
  • ISA (Internal Security Assessor) — internal personnel credential.

Adjacent PCI standards

  • PCI PIN — PIN security.
  • PCI 3DS — 3-D Secure.
  • PCI P2PE — point-to-point encryption.
  • PCI SSF (Software Security Framework) — secure software development for payment software.
  • PCI Card Production — card manufacturing security.

Adjacent regulations

  • GDPR — personal data overlap.
  • NIS2 — financial sector partial overlap.
  • DORA — financial services lex specialis for financial entities.

Reference resources

  • pcisecuritystandards.org — PCI SSC hub.
  • List of QSAs / ASVs — searchable directory.

See also