What category this is
The Payment Card Industry Data Security Standard (PCI DSS) is a global payment-industry security standard rather than a government statute. The PCI Security Standards Council (PCI SSC) states that PCI DSS establishes a baseline of technical and operational requirements designed to protect payment account data and promote consistent security measures worldwide.
Keep the institutional roles distinct: the Council develops and maintains the technical standard and qualifies assessors (Qualified Security Assessors, or QSAs) and Approved Scanning Vendors (ASVs), whereas validation and enforcement sit with the payment brands and acquiring banks.
Edition covered: PCI DSS v4.0.1
This explainer pins PCI DSS v4.0.1, Requirements and Testing Procedures, published in June 2024. On 11 June 2024, the Council published a PCI Perspectives announcement describing v4.0.1 as a limited revision of v4.0 that delivers formatting corrections and clarifications with no new or removed requirements.
That announcement also states that PCI DSS v4.0 retired on 31 December 2024, leaving v4.0.1 as the active edition supported by the Council. Both the standard and the Summary of Changes from v4.0 to v4.0.1 live in the PCI SSC Document Library.
Who the standard commonly frames
The Council defines the intended audience for PCI DSS as all entities that store, process, or transmit cardholder data (CHD) or sensitive authentication data (SAD), as well as entities that could impact the security of the cardholder data environment (CDE). That scope spans merchants, payment processors, acquirers, issuers, and service providers.
Notice how that definition follows payment data and the systems capable of affecting the payment environment. Whether a specific organization's billing portal falls into scope, and which validation pathway applies, is determined by the acquiring bank and payment brand program based on the real payment architecture, not by a checkout vendor's homepage slogan.
Validation runs through brands and acquirers
Compliance programs, validation schedules, reporting artefacts, and contractual consequences are administered by the payment brands and acquiring banks rather than by the PCI Security Standards Council itself.
In its announcement of the e-skimming information supplement, the Council states explicitly that PCI SSC does not enforce compliance or determine whether a specific implementation is compliant, and directs organizations to collaborate with the entities that manage their compliance programs, such as acquirers or payment brands.
When a vendor claims to be 'PCI certified by the Council,' recognize that phrasing as a category error. You verify payment-security obligations with your acquiring bank and review formal validation artefacts scoped to the actual service.
Draw the payment flow before a scope claim
In practice, PCI DSS scope and assessment effort depend on the exact mechanics of the checkout flow: whether the browser performs a full redirect to a payment service provider, renders an embedded iframe, or posts fields directly, and which server hosts the parent web page and its JavaScript bundles.
Outsourcing raw card storage to a payment processor never eliminates your responsibility for the parent page that loads the payment frame. Before claiming that an application is out of scope, map the end-to-end payment flow, inventory every script executing on the checkout page, and confirm the validation pathway with the acquirer.
E-skimming guidance is a supplement, not the standard
On 10 March 2025, the Council announced the information supplement Payment Page Security and Preventing E-Skimming to provide practical guidance on PCI DSS Requirements 6.4.3 and 11.6.1 for e-commerce environments and pages that embed payment iframes. The supplement walks through script authorization, script integrity verification, payment-page tamper detection, and security-relevant HTTP headers.
As the Council states in the release, the information supplement provides supplemental guidance and does not add, extend, replace, or supersede requirements in any PCI SSC standard. Requirements 6.4.3 and 11.6.1 live in PCI DSS v4.0.1 itself; the supplement explains engineering patterns for meeting them.
Rewrite the certificate sentence
Whenever a draft architecture review says 'we are PCI certified by the SSC,' rewrite it so the engineering and governance facts are exact: compliance validation runs through the payment-brand and acquirer programs against the active Council-supported edition, PCI DSS v4.0.1 (June 2024), after the retirement of v4.0 on 31 December 2024.
Keep payment account data distinct from general personal-privacy statutes so your team applies the right standard to each data flow.
Common misconceptions
PCI SSC issues a PCI certificate that proves we are compliant.
The PCI Security Standards Council maintains the technical standard and qualifies QSAs and ASVs, whereas payment brands and acquirers administer compliance validation programs.
If we never store the PAN on our servers, PCI DSS cannot apply, and we can ignore payment-page script controls.
PCI DSS applies not only to entities that store cardholder data, but also to entities whose systems can impact the security of the cardholder data environment, including parent e-commerce pages that host embedded payment frames.
The e-skimming information supplement replaces or adds mandatory requirements beyond DSS.
The Council states explicitly that the supplement does not add, extend, replace, or supersede requirements in any PCI SSC standard; it provides guidance for Requirements 6.4.3 and 11.6.1 inside PCI DSS.
An ASV scan alone is full PCI DSS validation.
An Approved Scanning Vendor performs external vulnerability scans for the applicable scanning requirement, which is only one component of a broader PCI DSS validation program overseen by the acquirer or payment brand.
A SOC 2 or ISO 27001 report means PCI is done.
SOC 2 and ISO/IEC 27001 deliverables evaluate a system or management system against their own respective criteria; they do not evaluate PCI DSS v4.0.1 or replace payment-brand and acquirer validation.
CHECK THE CATEGORY
A checkout team's architecture slide claims 'we are PCI certified by the SSC.' Which rewrite states the governance and edition facts accurately?
Glossary and nearby pages
Use the agency page in the sources for the authoritative text.