PCI DSS

Payment Card Industry Data Security Standard

Mandatory controls for any system handling cardholder data.

When you'd see it: Any system that stores, processes, or transmits credit-card data. PCI compliance is a precondition for taking card payments.

Why it matters: PCI DSS is the mandatory security standard for handling cardholder data, enforced by the card networks rather than a government. Most companies minimize scope by using a payment processor so card data never touches their own systems.

Common mistakes: Thinking PCI is optional or government-run. It is contractually required by the card brands, and non-compliance can mean losing the ability to take cards.